The changes to Cyber Essentials introduced in 2026 took effect on 27 April, when the scheme moved to version 3.3 of its Requirements for IT Infrastructure alongside a new self-assessment question set called Danzell. Cyber Essentials is still built around five technical controls, covering firewalls, secure configuration, security updates, user access and malware protection. Multi-factor authentication and security update timing can now fail an assessment outright. So can an incomplete cloud service scope. This guide walks through the changes to Cyber Essentials introduced in 2026, section by section, so you know what to check before your next renewal application goes in.
Cyber Essentials Changes in 2026 Explained
Cyber Essentials moved to version 3.3 of its Requirements for IT Infrastructure on 27 April 2026, alongside a new self-assessment question set called Danzell. An assessment account opened before that date continues under the previous version until it lapses. Any account opened from 27 April 2026 onwards is assessed under the current requirements.
Firewalls, secure configuration, security update management, user access control and malware protection remain the five controls behind Danzell. Cyber Essentials has not been rewritten. A small number of answers are now scored differently, concentrated in three areas covered in the sections below. A business that passed comfortably under the previous question set should not assume its next submission will look the same.
Why MFA Can Now Cause an Automatic Cyber Essentials Fail
Cyber Essentials has required multi-factor authentication for cloud services, which has been available for some time. Under the current requirements, missing it on any in-scope cloud service results in an automatic fail.
IASME, the scheme’s delivery partner for the National Cyber Security Centre, confirmed this in its April 2026 scheme update. Automatic failure applies whether MFA is free, bundled into the service, or sold as a paid add-on. There is no partial credit and no discretion for the assessor.
This means checking every cloud service your staff sign into. That includes email, file storage, your CRM, accounting software, and even a company social media account. Confirm whether MFA is available for each one and whether it is switched on. Administrative accounts and anything accessible from the internet carry the same expectation under the NCSC’s own guidance. A password alone is no longer enough to pass an assessment for any service where MFA exists, however minor that service seems.
Why the 14-Day Security Update Rule Matters at Renewal
The requirement to apply high-risk and critical security fixes within 14 days of release has been part of Cyber Essentials for years. Two questions covering this requirement are now marked as automatic fails under the current Danzell question set, confirmed by IASME in its April 2026 update.
One question covers operating systems and router or firewall firmware. The other covers applications, including their associated files and extensions. Miss the 14-day window on either question and the whole application fails, regardless of how well every other control performs.
Meeting this at renewal takes more than a general patching habit. A business needs a documented process that identifies which fixes count as high-risk or critical and applies them within the window across every device in scope. That last point matters most. IASME’s own audits have found organisations patching only the specific devices an assessor happened to sample, leaving the rest of the estate behind.
Cloud Services Must Be Included in Your Cyber Essentials Scope
If your organisation’s data or services are hosted on a cloud service, the current requirements state plainly that this service must sit inside your Cyber Essentials scope. It cannot be excluded. The National Cyber Security Centre sets out the full definition on its Cyber Essentials resources page.
Microsoft 365 is the clearest everyday example, but the same applies to any cloud application holding company data, including tools individual teams may have signed up for without formal approval. Responsibility for meeting the five controls is shared between your organisation and the provider and depends on the type of service. With a SaaS product like Microsoft 365, your organisation still owns user access control, whatever the provider secures on its side.
Getting this right at renewal starts with an honest inventory of the cloud services in active use across the business. Teams often adopt new tools without central sign-off, and any one of them can be pulled into scope if it stores or processes company data. It’s an area our cyber security team helps London businesses map out before an assessment.
What Should You Check Before Your Cyber Essentials Renewal?
Go through the following before your assessment begins.
- The full list of cloud platforms and services your business currently uses, including ones adopted informally by individual teams
- Whether MFA is switched on for every one of those services where it is available
- How your business identifies high-risk and critical security fixes as they are released
- Whether those fixes are applied within 14 days across your whole device estate
- Who holds responsibility for updates and security controls day to day
- Whether your Cyber Essentials scope reflects how the business operates today, including any new tools, services or ways of working since your last assessment
Working through this list takes time from whoever manages your cloud accounts and whoever owns IT decisions day to day. Doing it before you submit your application costs less time than doing it during the assessment itself.
Preparing for Your Cyber Essentials Renewal
Working through the checklist above before you apply is the best way to avoid a result you did not expect. Most of it comes down to visibility over which cloud services are in use and whether MFA and patching evidence would hold up if an assessor looked at either today.
If you would like help working through any of this before you submit, Platform365’s cyber security team can talk it over with you. Book a call with Dan to go over your Cyber Essentials renewal, or find out more about how we support businesses with compliance and certification.
FAQs
How often do you need to renew Cyber Essentials?
Cyber Essentials is renewed annually. Each certificate is valid for 12 months, and your next assessment is judged against whichever requirements are current when you apply, according to IASME.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials Plus covers the same five technical controls as the standard scheme but adds an independent technical audit to confirm the controls are correctly implemented. IASME prices this separately for each applicant, reflecting the extra time a technical audit takes compared with the standard self-assessment.
Do you need Cyber Essentials to bid for UK government contracts?
For certain public sector contracts, yes. Government guidance has required suppliers bidding for specified contract types to hold Cyber Essentials or Cyber Essentials Plus certification since 2014, particularly where the work involves personal data or government IT systems.
How much does the Cyber Essentials certification cost?
IASME sets a tiered price for the standard self-assessment, starting at £320 plus VAT for organisations with 0 to 9 employees and rising for larger organisations. Cyber Essentials Plus is priced separately, based on the size and complexity of the network being assessed.
