Cyber Essentials: the five failure points that cost first-time applicants

Boundary Control and the Myth of the Managed Network

The most frequent point of failure is a misunderstanding of the 'Boundary' requirement. Many founders assume that because they work from a coworking space or a home office, the perimeter is managed by a third party. However, Cyber Essentials explicitly requires the organisation to take responsibility for the first line of defence, which often means the software firewall on the individual laptop.

A common mistake is leaving default passwords on network equipment like routers or wireless access points. Auditors look for evidence that these have been changed. If you are using 'admin/password' or even a unique default etched onto the bottom of a router, you will fail the assessment immediately. It is an easily avoidable error but one that catches out those who rush the process.

Furthermore, inbound traffic must be restricted to only what is strictly necessary. If you have open ports for legacy services or remote desktop protocols (RDP) exposed directly to the internet without a VPN, your application will be rejected. The focus here is on reducing the attack surface to the absolute minimum required for business operations.

• Documentation of the business justification for every open inbound port.
• A strict policy of changing all default administrative passwords before deployment.
• Disabling Unpnp and other discovery protocols on hardware.
• Ensuring the software firewall is active on all endpoints, regardless of their location.

The Administrative Rights Trap

The principle of least privilege is central to the scheme, yet many small firms still allow staff to operate with full administrative rights on their daily machines. This is a critical failure point. If a user clicks a malicious link while logged in as an administrator, the malware has carte blanche to install itself and spread across your network.

To pass, you must demonstrate that administrative accounts are only used for administrative tasks. This means your developers, designers, and even the CEO should have a 'standard' account for their daily work and a separate 'admin' account used only when specifically needed. The logistical overhead of this is often what leads firms to cut corners, but the IASME requirements are inflexible on this point.

Account management also extends to the lifecycle of an employee. You must have a documented process for removing access when someone leaves the firm. An audit will often look for 'zombie' accounts—those belonging to former employees that were never disabled. If these accounts still have active permissions, it indicates a breakdown in your internal governance.

• Moving all users to standard accounts for daily tasks like email and web browsing.
• Maintaining a dynamic register of all administrative accounts and their owners.
• Implementing a policy that prohibits 'persistent' admin logins.
• Conducting quarterly reviews to revoke access for staff who have changed roles.

Patch Management: The 14-Day Deadline

Security updates are not a 'do it when you have time' task under Cyber Essentials; they are a 14-day mandate. Any 'Critical' or 'High' severity update released by a vendor must be applied to all in-scope devices within two weeks. For many founders, this highlights a lack of centralized device management (MDM), making it nearly impossible to prove compliance across a distributed team.

The presence of unsupported software is a guaranteed fail. If your team is still using an old version of Windows or an ancient build of a creative tool that the manufacturer no longer supports, you cannot be certified. There are no exceptions for 'specialised' software that the business relies on if that software represents a security risk.

Modern patch management requires a shift in culture. Instead of viewing updates as a nuisance that interrupts work, they must be viewed as a baseline requirement for doing business. Implementing an MDM solution is usually the only way to satisfy an auditor that your fleet is consistently patched without relying on the honesty of individual employees.

• Automating the installation of OS updates for Windows, macOS, and Linux.
• Ensuring third-party apps like browsers and PDF readers are updated within the 14-day window.
• Auditing hardware to identify 'End of Life' (EoL) devices that no longer receive security patches.
• Removing any software that is no longer strictly necessary for business functions.

MFA and the Complexity ConundrumBoundary Control and the Myth of the Managed Network

Multi-Factor Authentication (MFA) is now a mandatory requirement for all cloud services and internet-facing accounts. The most common reason for failure in this category is 'partial' implementation. For example, a firm might have MFA on their main email suite but forget to enforce it on their CRM or their code repository. If it is a business-critical service, it must be protected.

Password complexity is another area where firms struggle. Cyber Essentials promotes a move away from the traditional 'change your password every 30 days' approach, which often leads to users picking weak passwords with an incrementing number. Instead, it encourages long, unique passwords or the 'three random words' strategy, combined with MFA.

You must also have a clear policy for handling compromised passwords. If a breach is suspected, there must be a mechanism to force a password change and revoke active sessions. Auditors will look for the technical controls that prevent brute-force attacks, such as account throttling or lockouts after unsuccessful attempts.

• Enforcing MFA for all cloud services (M365, Google Workspace, Slack).
• Prohibiting the use of easily guessable passwords or common dictionary words.
• Blocking 'brute force' attempts by locking accounts after a set number of failed tries.
• Educating staff on the nuances of MFA fatigue and social engineering.

Scope Creep and Asset Blindness

You cannot secure what you do not know exists. A significant number of applicants fail because their asset inventory is incomplete. If an auditor discovers a 'shadow IT' server under a desk or a fleet of personal tablets accessing the corporate VPN that weren't declared in the scope, the assessment is void.

Defining the boundary is especially difficult for remote-first companies. Every home router used by an employee is technically out of scope, but the device connecting to it is very much in scope. This distinction is vital. You must be able to prove that the corporate data remains protected even when it leaves the 'physical' office.

Finally, the scope must include every device that can connect to the internet and access your data. This includes smartphones and tablets. Many founders overlook mobile security, assuming that an iPhone is inherently secure 'enough'. Under Cyber Essentials, if that iPhone is used to read corporate email, it must have a PIN/biometric lock, be patched, and have the ability to be remotely wiped.

• Maintaining an up-to-date hardware inventory including serial numbers and OS versions.
• Defining a clear 'BYOD' policy that mandates specific security settings on personal phones.
• Ensuring that guest networks are physically or logically separated from the production environment.
• Mapping out cloud service providers and their role in the data ecosystem.

Frequently asked questions