The UK's Cyber Essentials scheme changed in April 2026. Version 3.3 of the NCSC's "Requirements for IT Infrastructure" took effect on 27 April 2026, alongside a new question set called Danzell from IASME, the scheme's delivery partner. The headline change for UK businesses is that missing multi-factor authentication (MFA) on any cloud service where it is available, or failing to apply critical updates within 14 days, now means an automatic fail.
This is a summary for general information. Always check the current requirements and question set with your certification body before you apply.
Key takeaways
- Cyber Essentials v3.3 took effect on 27 April 2026, and missing MFA on any cloud service where it is available is now an automatic fail.
- High-risk or critical updates, including CMS plugins and themes, must be installed within 14 days of release or the assessment fails.
- Website hosting, domain registrar, DNS and CMS admin accounts count as cloud services and cannot be excluded from scope.
- Applications started before 27 April 2026 can continue under v3.2, with six months to certify under the previous requirements.
What happened
IASME announced the changes on 12 February 2026, giving organisations about ten weeks to prepare. The NCSC's Cyber Essentials resources page now lists v3.3 as the current version, effective from 27 April 2026. Version 3.2 had applied since 28 April 2025, and applications started before 27 April 2026 can continue under v3.2. IASME says organisations with an assessment account created before the cut-off have six months to certify under the previous requirements.
The main changes:
| Area | What changed in 2026 |
|---|---|
| MFA on cloud services | Mandatory wherever MFA is available, whether it is free, included or a paid add-on. Not enabling it is an automatic fail |
| Security updates | High-risk or critical updates for operating systems, router and firewall firmware, and applications (including extensions) must be installed within 14 days of release. Missing this is an automatic fail |
| Cloud services | New definition; cloud services that store or process your data cannot be excluded from scope |
| Web applications | Section renamed "application development" and linked to the government's Software Security Code of Practice. Publicly available commercial web applications are in scope by default; bespoke components are out of scope |
| Passwordless sign-in | Passwordless methods such as passkeys highlighted under user access control |
| Scope and declaration | All legal entities in scope must be listed, exclusions must be justified, and the director's declaration now covers ongoing compliance through the certification period |
| Cyber Essentials Plus | A failed device sample must be fixed and retested with an extra random sample; a second failure revokes the certificate |
The NCSC v3.3 document puts the MFA rule plainly: where MFA is available, "authentication to cloud services must always use MFA".
The changes sit alongside a wider NCSC shift on logins. In a blog post on 23 April 2026, published after CYBERUK 2026, the NCSC said it will recommend passkeys wherever a service supports them, with two-step verification as the fallback.
What this means for UK businesses
For a typical small business, the cloud services in scope will include email (Microsoft 365 or Google Workspace), accounting software, the CRM and, importantly, the tools that run your website: the hosting control panel, domain registrar, DNS provider, CMS admin accounts and any e-commerce platform. Under v3.3, all of these count, and any account that offers MFA must have it switched on.
The 14-day patching rule matters for websites too. If your site runs on WordPress or another CMS, plugin and theme updates are application updates. A critical plugin update left for a month could now fail an assessment, as well as leave the site open to attack.
Cyber Essentials is not just a badge. It is required for some central government contracts and is increasingly requested by larger customers in their supply chains. If you renew annually, your next renewal after 27 April 2026 will be under the new rules.
What to do now
- List every cloud service you use. Include website hosting, domain registrar, DNS, CMS and payment accounts, not only email and office software.
- Turn on MFA everywhere it is offered. Prioritise admin accounts. Where a service supports passkeys, consider using them, in line with the NCSC's April 2026 guidance.
- Set a 14-day patching routine. Enable automatic updates where safe, and check CMS plugins and themes weekly. Our WordPress security checklist covers the basics.
- Check your website's public-facing configuration. Run a free website audit with MakeItFlow to review your TLS certificate, HTTP security headers and whether
.envor.gitfiles are exposed. You can also check individual items with the SSL checker and security headers checker. These are not a Cyber Essentials assessment, but they catch common website weaknesses. - Review your scope statement. Make sure every legal entity is listed and any exclusions are justified and separated from in-scope systems.
- Get free help if you need it. In a blog post on 15 July 2026, the NCSC said NCSC-assured Cyber Advisors offer a free 30-minute session for small and medium-sized organisations starting Cyber Essentials, and that more than 760 small organisations had used it.
MakeItFlow is not a Cyber Essentials assessment, but it gives you an outside-in view of your website before an assessor or an attacker looks at it: the TLS certificate, HTTP security headers, exposed configuration files and DNS records. For a one-minute spot check, use the free SSL checker and security headers checker.
Frequently asked questions
Does my website count as part of Cyber Essentials scope?
The hosting, CMS and other cloud services behind it count, because v3.3 says cloud services that store or process your data cannot be excluded. Publicly available commercial web applications are in scope by default, while bespoke code you have built yourself is out of scope. Check the exact boundaries with your certification body.
What if my hosting provider charges extra for MFA?
IASME says MFA must be used wherever it is available, whether free, included or paid. If it is available and not enabled, the assessment fails automatically.
I started my application before 27 April 2026. Which rules apply?
According to the NCSC, applications started before 27 April 2026 can continue under v3.2. IASME says accounts created before the cut-off have six months to certify under the previous requirements.
Related reading
- Does a Small Business Website Need DDoS Protection?: Does a small business website need DDoS protection? Usually a free CDN layer is enough. Learn the real risks, what your host covers and how to prepare cheaply.
- WordPress 7.1.3 Security Release: What Site Owners Should Check: WordPress 7.1.3, released on 6 October 2026, fixes seven security issues including stored XSS and SQL injection. What site owners should check and update.
- How to Choose Web Hosting for a UK Business: A Practical Guide: Choose web hosting for a UK business by matching the hosting type to your site, then checking speed, support, backups, security and data location.
- Website Security Threats 2026: A UK Small Business Guide: The biggest website security threats for UK small businesses in 2026, backed by government breach data, plus a practical checklist to cut your risk this month.
Sources
- NCSC: Cyber Essentials resources (current requirements v3.3)
- NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3 (PDF)
- IASME: Important update, changes to Cyber Essentials for April 2026
- NCSC: Passkeys are more secure than traditional ways to log in
- NCSC: Helping small businesses with free, hands-on cyber consultancy
More guides for your industry
Free checklist (PDF)
Free it support & msps website checklist
31 practical checks for it support & msps: website speed and mobile, Google Business Profile and reviews, email security, booking and enquiry handling, and AI search visibility. Each one says why it matters, and many link to a free tool that checks it.
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above and this guide was last reviewed on 25 October 2026 . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
