Cyber Essentials in 2026: what changed in April

On 27^th April 2026, Cyber Essentials got stricter in the two places small firms most often slip. A cloud service without multi-factor authentication, when it offers it, now fails the assessment outright. So does a critical security update left uninstalled for more than 14 days.

The update also asks for more detail about who you are and what’s in scope, tightens the rules for Cyber Essentials Plus, and spells out what counts as a cloud service. The five controls the scheme is built on haven’t changed. How strictly they’re checked has.

Here’s what changed and what it means if you run an accountancy or tax practice. We update this post whenever the requirements change.

What changed, and when

The NCSC sets the requirements, and IASME, who deliver the scheme, publish the questions you answer. From 27^th April 2026, new assessments use version 3.3 of the requirements and a new question set called Danzell, published in February. Accounts opened before then have six months to certify against the previous version, known as Willow.

IASME’s summary of the changes is worth reading in full. These are the parts that matter most to a practice.

Missing MFA is now an automatic fail

Multi-factor authentication on cloud services has been a requirement for a while. What’s new is the consequence. If a cloud service offers MFA, whether it’s free, included or a paid extra, and it isn’t switched on for every user and every administrator, the assessment fails.

There are two ways to get this wrong. The obvious one is leaving MFA off somewhere. The less obvious one is listing a service as having no MFA option when it does: IASME check that list against their own reference, and a wrong entry fails too.

Most of the work is finding every service. Under the new definition, a cloud service is anything that holds or processes your data through an account, including accounts someone set up with a work email address. For a typical practice, that means:

• Your practice management, tax and accounts software, and your client portal
• Bookkeeping and payroll platforms your team logs in to for clients
• AML and ID checks, e-signature and document request tools
• Your password manager
• LinkedIn and any other social media accounts used for the practice

If someone signed up to a free tool with their work address two years ago and still uses it, that counts too. Cloud services can’t be left out of scope.

Late security updates are now an automatic fail too

Two questions about security updates are now automatic fails: one for operating systems and router and firewall firmware, and one for applications. Both ask whether high-risk and critical updates are installed within 14 days of release.

“High-risk or critical” is broader than it sounds. It covers anything the vendor rates critical or high, anything scoring 7 or more on CVSS (the industry’s standard severity scale), and any update where the vendor gives no severity at all. In practice, treat every security update as in scope.

This rarely fails because nobody turned on automatic updates. It fails because the update policy covers some devices and not others, or because a few laptops haven’t checked in for weeks and aren’t receiving anything. The answer has to be true for every device in scope, including personal phones with work email on them.

Everything must be supported on the day you’re certified

The update makes the “point in time” explicit: it’s the date your certificate is issued. Every operating system and application in scope has to be supported by its vendor on that day.

The obvious casualty is Windows 10, which reached the end of support in October 2025. A Windows 10 PC without an Extended Security Updates subscription is unsupported, and that fails twice over: once for running unsupported software, and again because it can’t receive the updates the 14-day rule asks for. If you still have one in the office, replace it or cover it before you apply.

More detail about your organisation

The questions now ask for more about who’s being certified:

• How many people work for you, counting contractors, agency staff and volunteers who can reach your data, not just employees.
• Every legal entity in scope. If your practice is an LLP with a separate limited company for payroll or another service line, each one has to be named. IASME will issue a certificate for each entity for a small fee.
• Your operational addresses, and how home workers connect: through their own router, one you provide, or a VPN.
• Network equipment by make, model and quantity, not just a description.
• A responsible person inside your organisation. It can’t be your outsourced IT provider. A partner or your practice manager is the usual choice, with your provider preparing the answers.

Certificates can now carry a fuller description of what’s in scope. Anything you leave out has to be documented too, though that part isn’t published.

Passkeys get a push

The user access control section now highlights passwordless sign-in, such as passkeys and FIDO2 security keys, and the requirements count FIDO2 authenticators as multi-factor in their own right. If you’re deciding how your team signs in, the scheme is nudging you towards passwordless. Our zero-trust login security guide covers how to get there on Microsoft 365.

Cyber Essentials Plus is stricter on retests

Cyber Essentials Plus adds a hands-on audit to the self-assessment, and two of its rules have tightened. You can no longer change your self-assessment answers once Plus testing has started. And if the sample of devices fails the security updates test, the retest covers the original sample plus a new random one. Fail that, and your Cyber Essentials certificate is revoked as well.

A free service worth signing up to first

The questions also ask whether you’ve signed up to the NCSC’s Early Warning service. It isn’t a requirement, but it’s free, takes a few minutes, and alerts you when the NCSC sees signs of an attack involving your network. Sign up before you answer.

What to do before your next assessment

Whether you’re renewing or applying for the first time:

1. List every cloud service anyone uses for work, and switch on MFA wherever it’s offered.
2. Check that updates reach every device, not just that a policy exists. Look for devices that haven’t checked in recently.
3. Replace or cover anything unsupported, Windows 10 first, before the date you expect to be certified.
4. Name a responsible person in the practice, and list every legal entity you want covered.
5. Only then apply. You have six months from applying to submit, and the fee isn’t refunded if you run out of time.

None of this is new security thinking. MFA and prompt updates have long been two of the most effective protections a small firm has. The scheme has simply stopped giving credit for nearly having them.

If you’d like to know where you stand, our Cyber Essentials page explains how we get practices ready, and a Technology Review will tell you how far off you are.