Cyber Essentials is Changing But is Your Business Ready?

Cameron Lewis l Thursday 12th March

The UK’s government-backed Cyber Essentials scheme is being updated to address today’s cyber threats. Starting 27 April 2026, all new Cyber Essentials and Cyber Essentials Plus assessments will use new requirements to help strengthen basic cyber security for organisations of any size.

The five core controls: firewalls, secure configuration, user access control, malware protection, and patch management, are staying the same, but the way they are assessed will be stricter.

Here are some of the key changes organisations need to be aware of:

Multi-Factor Authentication becomes mandatory
If a cloud service supports MFA, it must be enabled. Failure to implement it where available will result in an automatic assessment failure.

Cloud services are fully in scope
Organisations now need to show that their cloud platforms, SaaS tools, and identity providers are securely set up and well managed. It’s not enough to just rely on the provider’s security.

Stricter patching requirements
Critical and high-risk security updates must be installed within 14 days. This highlights the importance of staying on top of vulnerabilities.

Clearer scoping rules
Any system, device, or service connected to the internet is considered in scope unless you can clearly separate and justify it. This also covers remote workers, BYOD devices, and contractor equipment.

Greater scrutiny in Cyber Essentials Plus
Cyber Essentials Plus assessments will now include more detailed technical checks to ensure the controls listed in your self-assessment are actually in place across your organisation.

The main change for Cyber Essentials Plus occurs during the testing stage. If an organisation fails the initial test on a sampled device, they will be required to ensure any remediation action is applied to all devices within the organisation. During a retest, the assessor will now check a new randomly sampled device in place of any that failed previously. This applies to any devices found to have vulnerabilities deemed non-compliant under Cyber Essentials.  

This change will encourage companies to apply consistent updates across all devices rather than just a sample. It is important to note, that if a second failure occurs during the retest, the Cyber Essentials self-assessment can be revoked and the audit must be conducted again to achieve certification.

These updates don’t completely change the scheme, but they do set higher standards for proof and consistency. It’s no longer enough to just have policies; you need to show that your security controls are working.

If your organisation is planning to get certified or renew in 2026, now is a good time to check your MFA coverage, patching routines, and cloud security controls. This will help you avoid surprises during your assessment.

If you want help getting ready for the upcoming Cyber Essentials changes, our team can guide you through the process and help you stay compliant and secure.

‍