Many organisations assume Cyber Essentials is primarily a technical challenge. In reality, the most common obstacles are usually operational issues, poor visibility, and inconsistencies between documented processes and what’s actually happening within the business.
If you’re planning to achieve Cyber Essentials certification, understanding these common pitfalls can help you avoid delays, reduce remediation costs, and improve your chances of success first time.
1. An Unclear Assessment Scope
One of the biggest causes of confusion is uncertainty about what should be included within the assessment scope.
Businesses often struggle to produce a complete inventory of:
- Company devices
- Cloud services
- Networks
- User accounts
- Remote-working arrangements
Without a clear understanding of what systems and services are in scope, it becomes difficult to answer assessment questions accurately or demonstrate that security controls are consistently applied.
Top tip: Start by identifying all business-owned and managed assets before making security changes.
2. Unsupported or Poorly Maintained Software
Cyber Essentials requires organisations to manage security updates effectively. However, patch management is only possible when devices and software are supported, visible, and actively maintained.
Common issues include:
- Outdated operating systems
- Unsupported applications
- Forgotten laptops
- Legacy business software
- Devices that rarely connect to company systems
Unsupported technology often becomes one of the most expensive and time-consuming issues to resolve before certification.
3. Inconsistent Multi-Factor Authentication (MFA)
Many businesses have adopted MFA, but not always consistently.
It’s common to find:
- Some users protected by MFA while others are not
- Administrator accounts without MFA enabled
- Multiple administrator accounts sharing credentials
- Privileged accounts being used for day-to-day activities
These gaps not only increase security risk but can also create complications during the assessment process.
A good approach is to review all privileged accounts and ensure MFA is enabled wherever required.
4. Administrator Accounts Are Not Properly Managed
Administrator accounts deserve special attention because they have elevated permissions across business systems.
Some common problems include:
- Shared administrator logins
- Excessive administrator privileges
- Staff using admin accounts for everyday work
- Lack of account reviews
A well-managed environment typically separates standard user activity from administrative tasks and ensures only authorised users have privileged access.
5. The Documentation Doesn’t Match Reality
Perhaps the most common issue is when businesses complete the Cyber Essentials questionnaire based on written policies rather than actual system configurations.
For example:
- A policy states MFA is enabled everywhere, but exceptions exist.
- Patch management procedures are documented, but devices are missing updates.
- Access reviews are planned but not regularly completed.
This mismatch between documentation and reality often causes delays when evidence is reviewed.
Before submitting your assessment, validate your answers against:
- Microsoft 365 administration portals
- Device management systems
- Endpoint security tools
- User account reports
- Sample device checks
A Better Cyber Essentials Readiness Process
Rather than treating certification as a paperwork exercise, organisations should build a repeatable readiness process.
A practical approach is to:
1. Create a Complete Asset Inventory
Document all devices, cloud services, software, and user accounts.
2. Assign Ownership
Identify who is responsible for each Cyber Essentials control and where evidence can be obtained.
3. Test Representative Devices
Review a selection of workstations, laptops, and cloud platforms to verify controls are operating correctly.
4. Remediate and Retest
Fix any identified issues before reassessing.
5. Maintain an Evidence Pack
Store reports, screenshots, policies, and supporting documentation throughout the year rather than collecting them just before renewal.
Frequently Asked Questions
Does One Old Device Matter?
Potentially yes.
If a device falls within the assessment scope and doesn’t meet current Cyber Essentials requirements, it could affect the outcome of the assessment. It’s important to verify its status rather than assume it’s irrelevant.
Can Policies Alone Prove Compliance?
No.
Policies help demonstrate governance and intent, but organisations must also show that technical controls are implemented and operating effectively. Evidence is just as important as documentation.
Final Thoughts
Most Cyber Essentials challenges are not caused by highly technical security problems. They are usually the result of incomplete inventories, unsupported software, inconsistent access controls, and gaps between documented procedures and real-world practices.
By focusing on visibility, consistency, and ongoing operational processes, businesses can simplify certification, strengthen security, and make future renewals significantly easier.
Need Help Preparing for Cyber Essentials?
At Cyber Chameleon, we help organisations identify gaps, improve readiness, and achieve certification with practical, straightforward advice.
Book a free consultation and gain a clear understanding of your Cyber Essentials readiness.