Cyber Essentials 2026 Changes

Cyber Essentials: What’s Changing And What SMEs Need to Do Now

Cyber Essentials has been a key part of UK cyber security for years. It helps businesses protect themselves from the most common attacks.

In 2026, we will update the scheme to reflect how businesses operate today. It focuses on cloud services, identity security, and how organisations prove their security posture. These updates apply to new Cyber Essentials and Cyber Essentials Plus assessments created on or after 27 April 2026.

If your business uses cloud apps, these changes matter.

If you rely on Microsoft 365, these changes matter.

If you have remote workers, these changes matter.

If you need Cyber Essentials for tenders, these changes matter.

This guide breaks down the updates in plain English so you know what to expect.

A Quick Refresher: What Cyber Essentials Covers

Cyber Essentials focuses on five core technical controls: firewalls, secure configuration, patch management, user access control and malware protection. These core areas stay the same in the 2026 update.

However, the assessment will now check them more strictly and consistently.

What’s Changing in April 2026?

1. Multi‑Factor Authentication Becomes Mandatory

Multi‑Factor Authentication (MFA) is no longer just encouraged; it has become a mandatory pass/fail requirement.

According to IASME and the updated marking criteria:

• If a cloud service offers MFA, you must enable it.

• It doesn’t matter if MFA is free, included, connected through another service, or requires a paid tier.

• If MFA is available but not enabled, the assessment will automatically fail.

This reflects the rise in credential‑based attacks and the importance of account security.

2. Cloud Services Are Fully In Scope

For the first time, Cyber Essentials gives an official definition of a cloud service. It also confirms that we cannot exclude these services from scope.

A cloud service is an on-demand, scalable service.

Accessible online.

An organisational or business account uses it.

It stores or processes company data.

This covers:

• Microsoft 365

• Google Workspace

• CRM systems

• HR, accounting and industry‑specific SaaS tools

If your staff log in with a work account, include the service in your assessment.

This applies if it stores or processes organisational data.

3. Stricter Scoping and Transparency Requirements

The 2026 update requires clearer scoping and greater transparency. Organisations must:

• Justify any exclusions from the assessment scope

• Show how excluded areas are technically segregated (e.g. firewalls or VLANs)

• Clearly describe the entire scope with no word limit

• List all relevant legal entities associated with the certification

The goal is to ensure your assessment reflects your real working environment, not just a simplified segment.

4. Tighter Requirements for Patching and Updates

Under Cyber Essentials Plus and the new marking rules, failing to apply high‑risk or critical patches within required timeframes can result in an automatic fail. This includes patches for:

• Operating systems

• Applications

• Router and firewall firmware

This emphasises the importance of rapid patching to reduce the window attackers can exploit.

5. More Focus on Identity and Modern Authentication

The updated requirements place stronger emphasis on:

• MFA enforcement

• Identity security

• Passwordless authentication such as biometrics, passkeys or hardware security keys

Identity protection is becoming the foundation of cyber resilience.

What This Means for SMEs

Even if Cyber Essentials isn’t mandatory for your business, these changes influence wider expectations. Many SMEs will feel increasing pressure from:

• Clients and supply chains demanding higher standards

• Insurers expecting better controls for cyber insurance

• Tenders and bids requiring Cyber Essentials as a baseline

Treating Cyber Essentials as a once-a-year box-tick is no longer enough. The new rules support everyday operational security.

How to Prepare Now

Here are practical steps SMEs can take before April 2026:

Turn on MFA Everywhere

Check all cloud services your staff use and ensure MFA is active for every account, not just administrators.

Build a Cloud App Inventory

List all cloud tools used across your business: official apps, role‑specific tools and any “free” SaaS tools. If you use it with a work account and it processes data, it will be in scope.

Review Your Scope

If you plan to certify only part of your organisation, ensure that the area is truly separate. Explain clearly why any exclusions exist.

Strengthen Your Patching Process

Make sure critical updates are installed quickly and consistently across all devices and systems.

Plan When to Create Your Assessment Account

Any assessment account created on or after 27 April 2026 must use the new question set. Creating an account before that date may allow you to complete your next assessment on the existing version.

If you are looking into Cyber Essentials, please get in touch, and we will gladly help you through it.

Lyndsay Poore

Michael was really helpful and explained the options really clearly. He gave me lots of helpful suggestions to move us forward. Recommend

Louise Adams

Dan and the team at Better IT have been great. We recently transitioned across and they have worked hard to ensure all of our devices are secure and work well. Dan has been instrumental in this process and has helped to walk me through a number of "techy" things with patience and support. When answering queries the team are supportive and quick ensuring we can get online with minimal disruption.

Charlie Booth

Better IT have been absolutely fantastic for our business. They’ve helped us future-proof everything – from improving our systems and storage to enhancing our security and completely upgrading our phone setup. It’s made a huge difference and really brought us into the 21st century. The whole team is incredibly helpful, friendly, and always go above and beyond to get things sorted quickly and efficiently. Can’t recommend them enough!

Our company swapped to Better-IT early this year and wow, what a change from our last provider! They are very switched on, responsive, friendly and can never do enough to help. Paul recently went out of his way to help us update some policies. His knowledge and the templates provided were invaluable and saved us so much time. Our employees are now confident once again that when they need IT support, they will be able to speak with a team who have time for them and can quickly resolve any issues.

Stacey Watkinson

Fantastic, quick and friendly IT support! Thank you

UK Mosca

When our onsite IT resource unexpectedly took leave, Better IT quickly agreed to a weekly onsite presence. Alex's visits have helped to ensure our IT operations continue smoothly. Their professionalism, expertise, and commitment to outstanding service are not just better, but the best!

Peter Woodthorpe

We have used Better-IT for many years. Always responsive, knowledgeable and friendly. Highly recommended.

QualityChimp

Better-IT were able to quickly source some WiFi access points and host them. Although they weren't supporting them, Dan took the time to record a video on how to configure them which gave me a better understanding of how they talk to our firewall and get them working. Excellent service.