Cyber Essentials Just Got Tougher: What Changed

If your business holds a Cyber Essentials certificate, or you have been thinking about getting one, there is something you need to know. The rules changed in April 2026, and the goalposts have shifted enough that businesses renewing their certification could now fail on things that previously would have been fine.

Here is what changed, why it matters, and what you should do next.

What is Cyber Essentials?

Cyber Essentials is a UK government backed certification scheme owned by the National Cyber Security Centre (NCSC) and delivered by IASME, the NCSC’s Cyber Essentials Partner. It checks that your business has five core security controls in place: firewalls, secure configuration, user access control, malware protection, and security update management. Holding a certificate shows you have the security basics in place. It is required for many government and public sector contracts, and it is increasingly expected by larger clients as a condition of working together.

What happened in April 2026?

On 27 April 2026, IASME, the NCSC’s Cyber Essentials Partner, replaced the previous Cyber Essentials question set, known as Willow, with a new version called Danzell. This is now version 3.3 of the NCSC Requirements for IT Infrastructure, and it introduced changes that are catching some businesses out.

Change 1: MFA on cloud services is now a pass or fail

Multi-factor authentication (MFA) means using more than just a password to log in, for example an authenticator app code or a text message. Under the Danzell requirements, if a cloud service you use offers MFA and you have not switched it on for every user and administrator, you now automatically fail the whole assessment. Not a partial mark, and not just one section. The entire self-assessment fails.

What counts as a cloud service is broad. It includes:

• Microsoft 365 and Exchange Online
• Google Workspace
• Your CRM system
• Accounting software (Xero, QuickBooks, Sage Online)
• HR platforms
• Cloud file storage such as OneDrive, SharePoint, or Dropbox
• Project management tools
• Business social media accounts

If MFA is available on any of these, even as a paid add-on, and it is not enabled for all users, you fail. There is no exception.

Change 2: Cloud services have a formal definition and cannot be excluded

Cloud services have been in scope of Cyber Essentials since version 3.0 in 2022, so this is not new. What version 3.3 adds is a formal definition of a cloud service, along with a clear statement that cloud services cannot be excluded from the scope of certification. In short, a cloud service is an on demand service, reached over the internet and accessed through an account, that stores or processes your organisation’s data.

In practice, this means you need to map every cloud tool used for work. That often turns out to be a longer list than expected, particularly where staff have signed up to apps without IT’s knowledge.

Cyber Essentials and your wider data protection duties

The Information Commissioner’s Office (ICO), the UK’s data protection regulator, points to Cyber Essentials in its data security guidance as a good starting point for the “appropriate technical and organisational measures” required by Article 32 of the UK GDPR. The ICO is clear that Cyber Essentials is a baseline rather than a complete solution, and that, depending on what you do with personal data, you may need to go further.

The practical point is straightforward. If the ICO looks into a data breach, it is required to consider the technical and organisational measures you had in place. Being able to show a recognised baseline such as Cyber Essentials, alongside controls appropriate to your own risks, helps demonstrate that you took data protection seriously. For more on this, see our IT security page.

What we have already done for managed clients

If System Force IT manages your Microsoft 365 environment, MFA will already be enabled across your user accounts. We configure multi-factor authentication as a baseline default, so the Danzell MFA requirement should not catch you out on the Microsoft 365 side of things.

For clients going through a Cyber Essentials assessment, we can work through the full scope exercise with you, identifying every cloud service that falls in scope and making sure each one is configured correctly before you submit. Passing first time is always the goal, and with the new rules it is worth taking the time to prepare properly.

What to check if you manage this yourself

If you look after your own IT, here is a practical starting checklist before your next Cyber Essentials assessment or renewal:

• Is MFA enabled on every cloud service that supports it? Check Microsoft 365, your accounts package, CRM, file storage, and project tools. If MFA is available anywhere and not switched on, you will fail the whole assessment.
• Have you mapped every tool your team uses for work? Apps people have signed up to without IT’s knowledge (“shadow IT”) can bring services into scope that you had not accounted for.
• Are high and critical updates applied within 14 days? Under Danzell this is now an automatic-fail question (A6.4 and A6.5), covering operating systems, router and firewall firmware, and applications.
• Do you know when your certificate is due for renewal? If it falls in the next few months, now is the time to run through the new requirements.

Our IT support team can run a readiness check with you before you submit your assessment. It is considerably easier, and less stressful, to close gaps before the assessment than to explain a failed result.

Need help with Cyber Essentials?

Whether you are going for Cyber Essentials for the first time or renewing under the new Danzell rules, we can help you prepare properly and avoid the common failure points. Get in touch with the team and we will take a look at where you stand.

If you are a business in Gloucestershire or across the UK looking for managed IT support that keeps your security and compliance on track, we would be happy to have a conversation.