Skip to content
Made in the UK

Cyber Essentials

Why do clients fail Cyber Essentials Plus on software updates, and how do MSPs fix it?

By , CEO, CybaVerse. Last reviewed

Clients usually fail Cyber Essentials Plus on software updates because a high or critical fix has been available for more than 14 days, unsupported software is still installed, or devices were missed by software updates and scanning. MSPs avoid this by scanning every in-scope device weeks before the test, fixing what remains and rescanning to confirm.

This page is part of our Cyber Essentials guide.

What does the Cyber Essentials Plus test check on software updates?

The Cyber Essentials Plus test specification includes a remote vulnerability assessment of internet-facing systems and an authenticated scan of a sample of devices. A device fails if a high or critical vulnerability has had a vendor fix available for more than 14 days, as the requirements define.

The assessment is strict. The test specification says any single failed test case means the whole assessment fails. IASME's April 2026 update also tightened retesting: if a sampled device fails, the retest checks the original sample plus a new random sample.

What are the most common security-update failures?

Most security-update failures repeat across clients, and almost all of them are preventable with routine scanning and a little planning ahead of the assessment date. The table below lists the failures assessors most often find on sampled devices and the practical fix for each. Use it as a pre-assessment checklist for every client you support.

FailureWhy it happensFix
Fix older than 14 daysPatch cycle slower than the deadlineFaster deployment for high and critical fixes
Unsupported softwareOld apps or operating systems left in placeRemove, replace or take out of scope
Third-party apps missedRMM patches only the operating systemPatch browsers, readers and runtimes too
Fix needs a configuration changePatch alone does not close itApply the vendor's prescribed fix
Device missed entirelyNo agent or not on the asset listReconcile assets with scan coverage

How should MSPs prepare, step by step?

The steps below suit most MSPs preparing a client for Cyber Essentials Plus. They follow the Cyber Essentials requirements and the test specification. The key is to leave enough time between the first scan and the assessment date to fix, rescan and fix again if needed.

  1. Step 1: Confirm the scope

    Agree which devices, users and cloud services are in scope with the client.

  2. Step 2: Scan everything in scope

    Run a full authenticated scan two to four weeks before the assessment.

  3. Step 3: Remove unsupported software

    Uninstall or replace anything the vendor no longer supports.

  4. Step 4: Fix high and critical findings

    Apply patches or the vendor's prescribed fix for every finding over CVSS 7.

  5. Step 5: Rescan and confirm

    Rescan each device to prove the fixes worked before the assessor arrives.

Why does fixing just the sample not work?

Assessors test a representative sample, but clients cannot know in advance which devices will be picked. Under the April 2026 rules a failed sample leads to a retest that adds a new random sample, so fixing only the obvious devices is a gamble. Every in-scope device needs to meet the standard.

How does CybaVerse help?

CybaVerse delivers Cyber Essentials and Cyber Essentials Plus certification through MSPs as a service, and CybaOps vulnerability scanning helps teams find failures early. Treating certification as part of an ongoing security service means problems are caught throughout the year, not just weeks before the assessor arrives.

  • CybaVerse delivers Cyber Essentials and Cyber Essentials Plus certification, run through the CybaOps platform.
  • CybaOps vulnerability scanning helps you find and fix CE+ failures before the assessment.
  • Cyber Essentials Plus works best as part of an ongoing security service, not a once-a-year exam.
  • Internal scans run several times a day and external scans run daily.

CE+ update failures

Why clients fail CE+ on updates, and the fix

Why clients fail CE+ on updates, and the fix.

01 Readiness checks

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

CE+ update failures

02 The 5-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • Delivered with
  • Cyber Essentials & CE+
  • CybaVM

What else do MSPs ask about security-update failures?

These are the follow-up questions MSPs ask most about Cyber Essentials Plus and software updates.

What if a vendor has not released a fix?

The 14-day clock runs from when a fix is released. If no fix exists, follow the vendor's mitigation advice and record it. Check the latest requirements document and ask your certification body if you are unsure.

Does traffic-filtering workarounds count?

Not as a long-term answer for legacy unsupported operating systems. The test specification says traffic-filtering workarounds is not acceptable for them. Remove or replace unsupported systems, or take them out of scope where the rules allow.

How early should we start preparing?

Scan at least two to four weeks before the assessment. That leaves time to fix findings, rescan and deal with any devices where the first fix did not work.

What should you do next?

See how CybaVerse delivers Cyber Essentials Plus on the CybaOps platform page. MSPs can read about the CybaVerse partner model for MSPs.

Related: How do MSPs meet the 14-day remediation rule across every client? and patch management vs vulnerability remediation

See how CE+ preparation works with CybaOps scanning.

Book a CybaOps demo