Cyber Essentials 2026 Changes: What UK Businesses Need to Know

Cyber Essentials 2026: What Has Changed and What Your Business Needs to Do

Cyber Essentials is the UK government backed baseline for protecting organisations against the most common cyber attacks. On 27 April 2026 the scheme moved to version 3.3 of the NCSC Requirements for IT Infrastructure, assessed through a new question set called Danzell, which replaced the previous set known as Willow. Cyber Essentials is owned by the National Cyber Security Centre (NCSC) and delivered by IASME, the NCSC’s Cyber Essentials Partner.

This article explains the confirmed changes in version 3.3, what they mean in practice, and how System Force IT can help you prepare. These are confirmed requirements, not predictions.

The confirmed 2026 changes

1. Multi-factor authentication on cloud services is now a pass or fail

Where a cloud service offers multi-factor authentication (MFA), whether it is built in, included, or available as a paid option, MFA must be enabled for all users and administrators of that service. If MFA is available on a cloud service and it has not been enabled for everyone, the whole self-assessment is now an automatic fail. Under the previous question set this was a significant point of non-compliance that could, in some circumstances, still pass. Under Danzell it cannot.

What this means: review every cloud service your organisation uses and confirm MFA is switched on for all accounts, administrators included, wherever the service supports it.

2. High risk and critical security updates must be applied within 14 days

Two questions in the Danzell set, A6.4 and A6.5, are now automatic-fail questions. A6.4 covers high risk or critical security updates for operating systems and for router and firewall firmware. A6.5 covers the same for applications, including any associated files and extensions. In both cases the update must be installed within 14 days of release. Missing this on an in-scope device or system fails the assessment.

What this means: you need a dependable patching process that applies vendor rated high and critical updates within 14 days across operating systems, firewalls and routers, and applications.

3. Cloud services now have a formal definition and cannot be excluded from scope

Cloud services have been in scope of Cyber Essentials since version 3.0 in 2022, so this is not a new requirement. What version 3.3 adds is a formal definition of a cloud service, together with a clear statement that cloud services cannot be excluded from the scope of certification. In short, a cloud service is an on demand, scalable service hosted on shared infrastructure, reached over the internet, accessed through an account, that stores or processes your organisation’s data.

What this means: any cloud service used for work that holds or processes company data is in scope and must meet the controls, including the MFA requirement above.

4. Cyber Essentials Plus: changes to the technical audit

For the hands-on Cyber Essentials Plus audit, if a patching issue is found in the sample of devices tested, the assessor now takes a second, additional sample. Organisations can also no longer amend their self-assessment answers based on what the Cyber Essentials Plus testing finds. The self-assessment needs to be accurate before the audit begins.

5. Clearer scoping

The scoping questions have been made clearer, including how an organisation states whether the whole organisation or only part of it is being certified. Where part of the network is separated and excluded, that separation now has to be explained and justified.

What businesses need to do now

These changes reward preparation. The steps below will help you meet the version 3.3 requirements and, where it makes sense, strengthen your security beyond the Cyber Essentials baseline.

• Run a readiness check against the version 3.3 requirements before you start or renew, so gaps are found before they become a failed assessment.
• Build a complete inventory of the cloud services your organisation uses, including anything staff have signed up to without IT’s knowledge, and confirm each one is in scope.
• Enable MFA for every user and administrator on every cloud service that supports it.
• Put a patch management process in place that applies high and critical updates within 14 days across operating systems, firewall and router firmware, and applications.
• If you hold, or plan to hold, Cyber Essentials Plus, make sure your self-assessment is accurate before the audit, because answers can no longer be amended during testing.

Beyond the certification itself, we also help clients with endpoint protection, email security, managed backup and ongoing monitoring. These are not Cyber Essentials requirements. They are good practice that strengthens your wider security position and is increasingly expected by cyber insurers.

How System Force IT can help

We help businesses prepare for and achieve Cyber Essentials and Cyber Essentials Plus, and we build the wider security to go with it.

• Readiness assessment against the current version 3.3 requirements, with a clear list of what to fix first.
• Cloud service discovery and scoping, so nothing is missed.
• MFA rollout and enforcement across Microsoft 365 and other cloud services.
• Patch management that meets the 14 day requirement.
• Certification support, from questionnaire completion and evidence through to liaison with your assessor.

System Force IT is UKAS ISO/IEC 27001:2022 Certified, a Microsoft Solutions Partner and a RIPE NCC member, with 24/7 engineer led support. We have supported businesses through Cyber Essentials and Cyber Essentials Plus for years, and we take a security first approach rather than treating certification as a box to tick.

Get Cyber Essentials ready

If you are not sure whether your business is ready for the version 3.3 requirements, we can help. Book a Cyber Essentials readiness assessment with System Force IT, or call 01452 701355.