Cyber Essentials changes from April 2026: what small businesses need to know

What changed

On 27 April 2026, Cyber Essentials moved to version 3.3 of its requirements, with a new question set called Danzell. The five controls are the same, but several rules are now applied more strictly.

1. Two-step verification is an automatic fail

If a cloud service offers two-step verification (also called multi-factor authentication or MFA), it must be switched on for every user, not just administrators. This applies even if it's a paid extra. Before, gaps were sometimes noted as observations. Now they fail the assessment.

2. Cloud services are always in scope

Any cloud service that stores or handles your business data and is used with a work account counts, including email, file storage, accounting software and booking apps. You can't leave them out. You also need to understand which security settings are your responsibility and which are the provider's.

3. Updates within 14 days, strictly

Critical and high-risk security updates must be installed within 14 days of release. The rule isn't new, but it's now checked more strictly, and it covers router firmware and apps as well as operating systems. Automatic updates are the easiest way to comply.

4. A wider scope

Every internet-connected device that accesses business data is expected to be in scope unless you can justify leaving it out. That includes laptops used at home, staff's own phones used for work email, and contractors' devices. You also need to declare which legal entities the certificate covers.

5. Tougher Plus audits

For Cyber Essentials Plus, if a sample of devices fails the patching test, the assessor tests a second sample. If that fails too, the Plus assessment fails and the basic certificate is revoked, so you'd have to start again.

If you started before 27 April

Assessment accounts created before 27 April 2026 could be completed under the previous rules for up to six months, as long as the account stayed active. Anyone applying or renewing now is assessed under v3.3.

How to get ready

• List every cloud service you use, and check two-step verification is on for every user of each one.
• Turn on automatic updates on every device and app, and check your router updates itself.
• Replace or retire devices that no longer get security updates.
• Write down every device used for work, including personal phones used for email.

Our readiness report is written for the April 2026 rules, and flags every automatic-fail answer before you apply.

Common questions

When did the Cyber Essentials changes start?
On 27 April 2026, with requirements version 3.3 and the Danzell question set.

Is missing MFA an automatic fail?
Yes. If a cloud service offers two-step verification, it must be on for every user, even if it's a paid extra.

Can I leave cloud services out of scope?
No. Cloud services that hold your business data and are used with a work account are always in scope.