Three Automatic-Fail Areas in Cyber Essentials That SMEs Keep Missing

It is not always the big gaps that sink a Cyber Essentials assessment. Sometimes it is the small things — a cloud service left without multi-factor authentication, a patch sitting unapplied for 15 days, or a scope definition that omits a system the assessor counts. Under the Danzell standard (version 3.3), these are not minor findings. They are automatic failures.

If your organisation is planning a Cyber Essentials assessment — whether through self-assessment or the plus route — these three areas deserve your first attention. Not because they are difficult to fix, but because they are easy to overlook when you are managing IT alongside everything else.

Why Do the Danzell Changes Matter Now?

The Danzell update (version 3.3) took effect in April 2026, introducing three automatic-fail criteria that did not exist in the previous Willow question set. Unlike other findings, which can be addressed through compensating controls, an automatic fail means the certificate cannot be issued regardless of your overall security posture.

The October 2026 transition window has now closed. All assessments created after 26 October 2026 use the Danzell standard. If your certificate is expiring soon or you are planning your first certification, you will be assessed against these stricter criteria.

The good news: all three areas are straightforward to address once you know what to look for.

1. MFA on All Cloud Services — Not Just Email

The Danzell standard requires multi-factor authentication on every cloud service that stores, processes, or transmits data. This goes far beyond enabling MFA on your Microsoft 365 email — which most SMEs have already done — and extends to any cloud application your team relies on.

This includes:

• Cloud storage and file-sharing platforms (OneDrive, Dropbox, Google Drive)
• Customer relationship management systems
• HR and payroll software
• Project management tools
• Any web-based database or data store

The NCSC guideline is clear: any cloud service with user credentials must have MFA enforced. If your assessor finds one cloud service operating without MFA, the assessment fails automatically.

What to do: Inventory every cloud service your staff access. For each one, verify that MFA is enforced at the account level — not just offered, but required. For Microsoft 365 services, this means checking every workload, not just Exchange. For third-party applications, check whether the provider supports MFA and whether it is activated across all user accounts.

If your organisation uses a small number of cloud applications, this is a configuration task. If your team has independently subscribed to services, the harder work is getting visibility of what exists — which is precisely why the Security Triage Call can help you map your current posture before an assessment.

2. The 14-Day Patching Rule

Under Danzell, all internet-connected devices must have security patches applied within 14 days of availability. This is not a recommendation. It is an automatic-fail criterion.

The previous Willow standard asked whether patching was performed regularly. Danzell measures how quickly it happens. If an assessor finds a critical security patch that has been available for more than 14 days on any internet-connected device — and there is no documented, compensating reason for the delay — the assessment fails.

This includes servers, workstations, network devices, printers, and IoT equipment that connect to the internet.

What to do:

• Establish which devices are internet-connected across your estate. Many SMEs are surprised by how many: smart TVs in meeting rooms, IP cameras, networked printers, remote access appliances.
• Verify that automated patching is enabled on all endpoints and servers.
• Create a simple log showing patch application dates for critical and security updates.
• Where a device cannot be patched within 14 days (legacy equipment, specialised systems), document the compensating controls: network segmentation, restricted internet access, firewall rules. Note that compensating controls may not always save you on the patching criterion itself, but they demonstrate a reasoned approach to risk management.

For SMEs without a standardised device build, patching consistency is the hardest part to maintain. This is covered in more detail in our guide to patch management for SMEs, but the bottom line is the same: automate it or accept the risk.

3. Correct Scope Definition

The third automatic-fail area is less about technical configuration and more about scope — the list of internet-facing assets that the assessor reviews.

A scope definition failure occurs when your assessed organisation does not include all internet-facing systems. If the assessor discovers a server, remote access point, or cloud service that operates your organisation's business function but was excluded from your scope, the assessment fails automatically.

Common omissions:

• Developer or staging servers accessible from the internet
• Remote access gateways that are not part of your primary IT estate
• Cloud services managed by a previous MSP who no longer works with you
• Subdomains with publicly accessible admin panels
• IoT devices with internet-facing management interfaces

What to do: Before submitting your self-assessment or booking an audit, walk through your business's internet footprint from the outside in. Start with your website and work backwards — what infrastructure does it depend on? Are there any systems that staff use remotely that connect to the internet? Are there any accounts or services left behind from a previous IT provider?

A complete scope inventory is not something you usually do unless something goes wrong. The Security Triage Call is designed to help you build one — it is the diagnostic first step that maps your current environment against Cyber Essentials requirements.

How to Prepare Before Your Assessment

If you are planning a Cyber Essentials certification, there is a practical order of operations:

1. Scope inventory. List every internet-facing system before you fill in any questionnaires.
2. MFA check. Verify every cloud service has MFA enforced, not just available.
3. Patching audit. Confirm critical patches are applied within 14 days across all internet-connected devices.
4. Evidence gathering. Collect screenshots, configuration outputs, and policies that prove each control is in place.
5. Self-assessment completion. Fill out the questionnaire honestly, mapping your evidence to each control.

This is not a complicated process. It requires discipline and attention to detail — two things that tend to get overlooked when an SME is juggling day-to-day operations alongside a certification project. That is where structured support helps.

Frequently Asked Questions

Can I still pass Cyber Essentials if one device is unpatchable?

The Danzell standard requires patches within 14 days for internet-connected devices. If a legacy device cannot be patched, you must document the compensating controls — network segmentation, restricted access, firewall rules — and explain why the device is necessary. However, compensating controls do not always override an automatic-fail criterion. The safest approach is to isolate the device from the internet entirely during the assessment period.

Does Cyber Essentials Plus have different automatic-fail criteria?

Yes. Cyber Essentials Plus includes an external vulnerability scan in addition to the self-assessment questionnaire. The automatic-fail criteria from the standard still apply, and the vulnerability scan introduces additional fail conditions — for example, critical vulnerabilities found during the scan that correspond to unpatched systems. The three automatic-fail areas covered in this article apply to both routes.

What happens if my organisation fails Cyber Essentials?

You can re-submit once the failing controls have been addressed. There is no waiting period between attempts, though the assessor will charge the full fee again. For organisations that need Cyber Essentials to bid on government contracts or meet client requirements, a failed assessment delays commercial activity. This is why many SMEs use the Security Triage Call to identify gaps before they reach the assessment stage.

Is Cyber Essentials worth the effort for a small business with few employees?

Yes. Cyber Essentials certification is increasingly expected in commercial tender processes, and 5% of UK small businesses currently hold it — meaning it is still a differentiator. Beyond procurement, the five core controls covered by the standard address the most common attack vectors affecting SMEs, particularly phishing and basic malware.