Solusec on Fast Cyber Essentials: What Happens If Your Application Fails?

Nobody sets out to fail their Cyber Essentials assessment, yet it happens more often than many businesses expect. The scheme is pass or fail, built on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. If your answers show that any of these are not met, no certificate can be issued, however urgent your deadline. A failed application is rarely the end of the road, though. Knowing what happens next makes the difference between losing a couple of days and losing several weeks.

Why Applications Fail in the First Place

Most failures come down to a few recurring problems. Unsupported operating systems or applications top the list, followed by multi-factor authentication missing on a cloud service and staff using administrator accounts for everyday tasks. Patching is another stumbling block, especially when a policy says updates are applied promptly but nobody can confirm it happens. Scope causes trouble too, where home workers' devices are left out without good reason. None of this means your business is careless. IT environments simply grow over time, leaving forgotten equipment and accounts behind.

What the Feedback Should Tell You

A good assessor will not hand back a bare fail. At Solusec, submissions are reviewed by a qualified, certified assessor rather than an automated system, and feedback explains in plain language which controls were not met and what is needed. That matters because vague feedback leads to guesswork, and guesswork leads to second failures. Share the feedback with whoever manages your IT and ask if anything is unclear. Because Solusec is an appointed IASME Certification Body, you speak directly to the team that assessed you, not a reseller.

Understanding the Free Resubmission Window

Under the current scheme rules, you get one free resubmission within a limited window if your first attempt does not pass. In most cases you can fix the problems, update your answers and be reassessed without paying again. The window does not stay open forever, though. Miss it, or fail the resubmission, and you will need to start a new application and pay again. So treat the resubmission seriously. Fix the underlying issues properly, recheck your other answers, and only resubmit once every control is genuinely in place.

How a Failure Affects Your Deadline

The real cost of a failure is time. Every cycle adds the fix itself plus another assessment turnaround, and some fixes are slow. Replacing an unsupported server or migrating a legacy application can take weeks. If you are working to a tender, contract start or insurance renewal, be upfront with the organisation asking for the certificate. Most buyers would rather hear early that you are resolving an issue than discover on the last day that the certificate is missing. A quick assessment only helps once the fix is complete.

Reducing the Risk Before You Submit

The best way to handle a failed application is to avoid one. If you are unsure whether your controls stand up, a gap analysis before you apply is worth far more than a faster assessment afterwards. Solusec offers this as an add-on, telling you precisely what needs fixing before you submit, and an urgent turnaround option if your deadline is close. You can read more about how Solusec approaches fast cyber essentials, including turnaround times and fixed pricing. A failure is recoverable, but a first-time pass is always quicker.