Cyber Essentials has been the UK’s baseline cyber security certification for more than a decade. But if your business is already Cyber Essentials certified, don’t assume this year’s renewal will be the same as last year’s.

The Cyber Essentials Changes in 2026 put much greater emphasis on two of the weaknesses attackers exploit most often: cloud accounts without multi-factor authentication (MFA) and software that isn’t patched quickly enough.

The five core technical controls haven’t changed. What has changed is how strictly some requirements are assessed.

What is Cyber Essentials and why does it matter?

Cyber Essentials is a UK government-backed certification scheme designed to help organisations protect themselves against common cyber attacks.

It is backed by the National Cyber Security Centre (NCSC) and delivered by IASME through more than 300 licensed certification bodies.

The scheme is built around five technical controls:

• Firewalls
• Secure configuration
• Security update management
• User access control
• Malware protection

These controls are designed to address basic but significant security weaknesses.

For a small or medium-sized business, that’s important because you don’t need to be the target of a sophisticated nation-state attack to have a serious cyber incident.

A compromised Microsoft 365 account, an unpatched application or a stolen password can be enough to give an attacker a way into your business.

Cyber Essentials helps you identify and close those gaps.

It can also provide reassurance to customers, suppliers and other organisations that you have taken recognised steps to protect your IT infrastructure.

Cyber Essentials Changes in 2026: What’s actually different?

The Cyber Essentials Changes in 2026 came into effect in April 2026 and apply to assessment accounts created from that point onwards.

The most important changes for business owners are:

• MFA is mandatory on all cloud services where it is available.
• High-risk and critical security updates must be installed within 14 days.
• Cloud services now have a formal definition and cannot simply be excluded from your assessment scope.
• Requirements around scope, legal entities and the board declaration have been made more precise.
• Cyber Essentials Plus testing has been tightened to close loopholes around device sampling and changing answers during testing.

The changes are about making sure those controls are actually being applied where they matter.

Two Cyber Essentials requirements can now cause an automatic fail

Two areas that previously had more flexibility are now auto-fail questions.

1. MFA is now required on cloud services

If a cloud service offers MFA, you must use it.

That applies whether MFA is:

• Free
• Included in your existing subscription
• A paid add-on

Previously, a business might have argued that MFA wasn’t being used because it was an additional paid feature.

That is no longer an acceptable answer under the new requirements.

If the cloud service offers MFA and you haven’t enabled it, you can fail the assessment.

For business owners, this is particularly important because cloud accounts are now at the heart of most businesses.

Think about the systems your employees use every day:

• Microsoft 365
• Google Workspace
• Accounting software
• CRM systems
• HR platforms
• Cloud storage
• Payroll systems
• Project management software

If these systems contain business information and can be accessed over the internet, they need to be considered when assessing your Cyber Essentials scope.

The good news is that enabling MFA is usually a configuration change rather than a major security investment.

2. Critical and high-risk updates must be installed within 14 days

The second major change concerns software updates.

Under the 2026 requirements, high-risk or critical security updates and vulnerability fixes must be installed within 14 days of release.

This applies to:

• Operating systems
• Applications
• Routers
• Firewall firmware
• Associated files and extensions

Why are these Cyber Essentials Changes important?

Cyber criminals don’t always need sophisticated hacking techniques.

Sometimes they just need:

A stolen password + no MFA

or

An unpatched piece of software + an exploitable vulnerability.

These are practical, real-world weaknesses.

The 2026 update therefore puts greater emphasis on making sure businesses aren’t technically compliant on paper while leaving obvious security gaps open in practice.

That’s good news for businesses.

Cyber Essentials shouldn’t be about ticking boxes simply to obtain a certificate. It should help make your business harder to attack.

What about Cyber Essentials Plus?

If your business has Cyber Essentials Plus, there are additional changes to the testing process.

The 2026 update closes two potential loopholes.

If devices selected during testing fail update checks, the organisation must fix the issue and then be tested against a new random sample.

That means you can’t simply fix the machines that happened to be selected and assume the rest of the estate is compliant.

You also can’t change your verified self-assessment answers once Cyber Essentials Plus testing has started.

These changes make Cyber Essentials Plus a stronger indication that an organisation’s security controls are actually working across its IT environment.

If you have questions about Cyber Essentials, let’s have a chat