Introduction

Cyber threats are evolving faster than ever, and so are the standards designed to protect against them. The UK’s Cyber Essentials and Cyber Essentials Plus schemes remain some of the most widely recognised frameworks for baseline cyber security, helping organisations defend against common attacks and demonstrate compliance.

For IT managers, CISOs, compliance officers, and UK SMEs, achieving certification is no longer just a “nice to have.” It is often a requirement for contracts, partnerships, and even cyber insurance.

To keep pace with modern risks, the framework is regularly updated. The April 2025 and April 2026 (v3.3 “Danzell”) updates introduce significant changes that organisations must understand to maintain or achieve certification.

Why the Cyber Essentials Framework Is Changing

The updates are driven by real-world shifts in how organisations operate and how attackers exploit weaknesses.

Key drivers include:

• Evolving threat landscape – Attackers increasingly use automated tools and credential-based attacks rather than complex exploits
• Cloud adoption – Businesses are relying more on SaaS, IaaS, and hybrid environments
• Remote and hybrid working – The traditional network perimeter has effectively disappeared
• Identity-based attacks – Compromised credentials are now one of the most common breach vectors

In short, cyber security is no longer just about protecting devices, it is about securing identities, access, and cloud environments.

Key Changes in the April 2025 Update

The April 2025 update laid the groundwork for a more modern, flexible, and cloud-aware framework.

1. Recognition of Passwordless Authentication

Cyber Essentials began formally recognising passwordless authentication methods, such as:

• Biometrics (e.g., fingerprint, facial recognition)
• Hardware security keys
• App-based authentication

This reflects a shift away from traditional passwords, which are often weak or reused.

2. Increased Focus on Cloud Security Controls

Cloud services are no longer treated as secondary components. The update introduced clearer expectations around:

• Secure configuration of cloud platforms
• Access control and user permissions
• Responsibility under the shared responsibility model

3. Updated Terminology

The framework moved away from outdated language such as “home working” and replaced it with broader terms like:

• Remote working
• User devices outside the office environment

This reflects the reality of modern work patterns.

4. Expanded Scope: Mobile Devices and IoT

The scope of Cyber Essentials expanded to better reflect real-world environments, including:

• Smartphones and tablets used for business
• Internet of Things (IoT) devices connected to networks
• Non-traditional endpoints accessing company data

5. Refinements to Cyber Essentials Plus Testing

The Cyber Essentials Plus updates focused on improving consistency and rigour:

• More standardised testing approaches
• Clearer guidance for assessors
• Reduced ambiguity in pass/fail criteria

This ensured organisations are assessed more fairly and consistently.

Key Changes in the April 2026 Update (v3.3 “Danzell”)

The Cyber Essentials changes 2026 represent a significant step forward in tightening controls and removing ambiguity.

1. Mandatory MFA Wherever Available

One of the most impactful updates:

• Multi-Factor Authentication (MFA) is now mandatory wherever it is available
• Failure to enable MFA where possible will result in automatic certification failure

This applies especially to:

• Cloud services (e.g., Microsoft 365, Google Workspace)
• Administrative accounts
• Remote access systems

2. All Cloud Services Explicitly in Scope

Previously, some organisations interpreted cloud services as partially out of scope. That is no longer acceptable.

Under Cyber Essentials requirements v3.3:

• All cloud services must be included in scope
• Organisations must account for:
  • SaaS platforms
  • Cloud-hosted infrastructure
  • Data storage services

3. 14-Day Patching Requirement

Patch management has become far stricter:

• High and critical vulnerabilities must be patched within 14 days

This reduces the window of opportunity for attackers exploiting known vulnerabilities.

4. Stronger Identity Security Requirements

Identity is now central to cyber security controls:

• Stricter controls on user access and permissions
• Greater emphasis on least privilege
• Secure authentication mechanisms required

5. Increased Emphasis on Evidence and Auditability

The framework now expects organisations to clearly demonstrate compliance:

• Documented policies and procedures
• Evidence of controls being implemented
• Clear audit trails

This marks a move away from simple self-declaration.

6. Alignment Between Self-Assessment and Cyber Essentials Plus

The gap between basic certification and Plus has narrowed:

• Self-assessment answers must accurately reflect real-world controls
• Cyber Essentials Plus audits will validate those claims more rigorously

What These Changes Mean for Organisations

The updates are not just incremental, they fundamentally shift how organisations approach certification.

Greater Accountability for Cloud Environments

You are now fully responsible for securing your cloud services, not just your internal network.

Stricter Patch Management Processes

A 14-day patching window means:

• Faster response times
• Better vulnerability tracking
• Improved asset visibility

Identity Security Becomes Central

Expect to prioritise:

• MFA everywhere possible
• Passwordless strategies
• Strong access control policies

Less “Tick-Box,” More Real Security

Assessments are becoming:

• More evidence-driven
• Less reliant on assumptions
• Closer to real-world security posture

Practical Steps to Prepare

To stay compliant with Cyber Essentials changes 2026 and upcoming audits, organisations should act early.

1. Conduct a Gap Analysis

• Compare your current controls against Cyber Essentials requirements v3.3
• Identify areas of non-compliance

2. Enforce MFA Across All Services

• Prioritise cloud platforms and admin accounts
• Remove exceptions wherever possible

3. Review Your Cloud Inventory and Scope

• Identify all cloud services in use
• Ensure they are properly secured and documented

4. Improve Patch Management SLAs

• Implement automated patching where possible
• Monitor vulnerabilities continuously
• Ensure critical updates are applied within 14 days

5. Strengthen Documentation and Evidence

• Maintain clear records of:
  • Security policies
  • Access controls
  • Patch management processes

This will be crucial for both certification and audits.

Conclusion

The latest Cyber Essentials Plus updates and the introduction of Cyber Essentials requirements v3.3 reflect a necessary evolution in UK cyber security certification.

Rather than adding unnecessary complexity, these changes:

• Address modern attack methods
• Strengthen protection around identity and cloud systems
• Ensure organisations implement meaningful, real-world controls

For UK SMEs and larger organisations alike, early preparation is key. Leaving updates until the last minute could result in certification delays, or worse, failure.

Ready for Cyber Essentials 2026?

If you are unsure whether your organisation meets the new requirements, now is the time to act.

Assess your readiness, identify gaps, and put the right controls in place before your next certification.

Or, if you would prefer expert guidance:

Work with a trusted IT partner to simplify the process, ensure compliance, and strengthen your overall security posture.

Do not wait for a failed assessment to highlight the gaps, get ahead of the changes today.