Cyber Essentials is straightforward when the basics are right, but small configuration and scope mistakes can still delay certification. Here are 12 common pitfalls UK organisations should address before applying in 2026.
Cyber Essentials is designed to be achievable for organisations of all sizes. The five technical controls remain focused on the fundamentals: firewalls, secure configuration, security update management, user access control and malware protection.
That does not mean certification is automatic. Most Cyber Essentials problems are not caused by sophisticated attacks or unusual technology. They are caused by ordinary things that have been overlooked: an administrator account without MFA, an old laptop that is still technically in use, a browser that has not updated, a cloud service missing from scope, or a critical security update that has been waiting too long.
The 2026 changes make some of these mistakes more significant. The current Cyber Essentials Requirements for IT Infrastructure v3.3 apply to assessment accounts created from 27 April 2026. Missing MFA on cloud services where it is available, and failing the relevant 14-day security-update questions, can result in automatic assessment failure.
For the fundamentals, see the Cyber Essentials certification guide. This article focuses on the practical oversights that commonly delay an application or create avoidable problems during Cyber Essentials Plus preparation.
The 12 Common Pitfalls at a Glance
1. Leaving MFA Disabled on a Cloud Service
Multi-factor authentication is one of the most important Cyber Essentials issues in 2026. MFA is required for cloud services where the service makes it available, whether it is free, included in the licence or offered as a paid option. Failing to implement it can result in an automatic failure.
Do not restrict the review to Microsoft 365 or Google Workspace. Consider every cloud service within scope, particularly systems containing business information or accessed by organisational users. Build a simple inventory and record the authentication method for each service before assessment.
2. Allowing Critical or High-Risk Updates to Exceed 14 Days
Having automatic updates enabled does not necessarily prove that every required update has installed. Cyber Essentials requires high-risk and critical security updates to be installed within 14 days of release. The 2026 question set includes auto-fail questions covering operating systems, router or firewall firmware and applications.
- A device has not restarted after an update.
- An application uses its own updater.
- Firewall firmware requires manual intervention.
- An employee rarely connects a laptop to the management platform.
Check the actual installed versions rather than relying solely on the existence of an update policy. Your vulnerability management process should make overdue updates visible before you submit the assessment.
3. Keeping Unsupported Software Because It Still Works
Software can work perfectly and still be unsuitable for Cyber Essentials. Operating systems, applications and devices within scope must remain supported by the vendor where security support is required.
- Old utilities and specialist applications.
- Obsolete browser versions.
- Unsupported operating systems.
- Equipment kept in service beyond its support lifecycle.
4. Getting the Scope Wrong
If organisational data or services are hosted in cloud services, those services must be considered when determining scope. Home and remote-working devices used for organisational business can also be relevant. Start from where our organisational data and services are, which devices access them, and how those devices reach the internet, rather than what you would like to certify.
5. Forgetting About Remote Workers and BYOD
A laptop being in somebody's home does not automatically put it outside Cyber Essentials. Remote-working devices used for organisational business may still be relevant to scope. BYOD can also introduce questions around supported operating systems, software firewalls, user access, applications and organisational data.
6. Giving Too Many People Administrator Rights
Administrator access should be reserved for activities that genuinely require it. Everyday browsing, email and routine office work should not normally be performed using privileged administrator accounts. Review privileged accounts before assessment and remove rights that are no longer required.
7. Forgetting Old, Shared or Leaver Accounts
User access control is not only about creating accounts securely. It also means removing access when it is no longer required. Dormant accounts, former employees, temporary contractors and unnecessary shared logins can weaken an otherwise well-managed environment.
- Microsoft 365 and identity platforms.
- Cloud applications.
- Local device accounts.
- Administrator accounts.
8. Leaving Default Settings and Unnecessary Services Enabled
Secure configuration means reducing unnecessary opportunities for an attacker. Review unnecessary services, unused accounts, default credentials, remote administration and features nobody requires. Pay particular attention to internet-facing equipment such as routers, firewalls and remote-management interfaces.
9. Assuming the Firewall Is Fine Because the Internet Works
A working internet connection tells you almost nothing about whether the firewall is securely configured. Cyber Essentials expects unnecessary inbound connections and exposed services to be controlled. Old port-forwarding rules for suppliers, CCTV systems, remote-access tools or retired servers can remain long after the original need has disappeared.
10. Overlooking Browsers and Everyday Applications
Patch management does not end with Windows Update. Browsers, PDF software, collaboration tools, remote-access software, Java or runtime components and common business applications need security updates too. An organisation can have fully patched Windows devices and still have application-layer vulnerabilities.
11. Treating Cyber Essentials Plus as Just Fix the Sample
Cyber Essentials Plus tests a sample of devices, but the controls apply to the wider environment within scope. Prepare the whole environment rather than only the devices expected to be tested. For a deeper audit-focused checklist, read Common Cyber Essentials Plus Failures.
12. Waiting Until the Assessment Starts to Find the Problems
Cyber Essentials should confirm that your controls are in place. It should not be the first time anybody has checked them. A readiness exercise can uncover unsupported devices, MFA gaps, old accounts, missing updates and scope problems while there is still time to fix them calmly.
Use a structured readiness check before submitting, and record an owner and target date for every gap you find.
The Five Controls Still Matter More Than Complexity
- Firewalls
- Secure configuration
- Security update management
- User access control
- Malware protection
The 2026 changes do not replace those principles. They make it harder for serious gaps, particularly missing MFA and overdue important security updates, to pass unnoticed.
A Note About Backups
Backups are important cyber security practice, but backup and recovery are not a sixth Cyber Essentials technical control. Keep that distinction clear. Managed Security can support ongoing security and resilience after certification, but it should not be confused with the five controls used by the scheme.
Preparing for Cyber Essentials Plus
If you plan to progress directly from Cyber Essentials to Cyber Essentials Plus, prepare with the technical audit in mind from the beginning. Verify device versions, patch status, security configuration, MFA, user access and software support across the environment rather than simply preparing questionnaire answers.
Cyber Essentials Plus readiness and remediation can help turn those checks into a practical preparation plan.
Flexible Ways to Pay
For businesses that want Cyber Essentials Plus but would rather avoid paying the full service cost upfront, eligible Cyber Essentials Plus and Combined Cyber Essentials and Cyber Essentials Plus packages can be spread across 12 monthly payments.
Monthly payment is a 12-month payment arrangement for the certification service rather than a cancel anytime subscription.
View Cyber Essentials & Plus Pricing
Before You Apply
- Cloud services and MFA.
- Administrator accounts and leavers.
- Software support dates and security updates.
- Internet-facing services and firewall rules.
- Device scope, remote workers and BYOD.
The best time to discover a Cyber Essentials problem is before the assessment begins. A relatively small amount of preparation can prevent one forgotten system delaying an otherwise well-managed organisation.
Ready to Get Cyber Essentials Certified?
Zenguard Cyber can help you understand the assessment requirements, identify gaps and prepare for certification with practical, straightforward support.
