Cyber Essentials April 2026 Update: What UK SMBs Miss

By IT Outcomes

16 June 2026
5 min read

Share this post

If you renewed Cyber Essentials last year, there is a fair chance you would not pass in the same way today.

The Cyber Essentials April 2026 update tightened the rules around cloud services, multi-factor authentication and software updates. For a 25-person accountancy firm, a charity with trustees using personal laptops, or a school with a mix of staff devices and cloud systems, the risk is not usually a dramatic cyber failure. It is a quiet compliance gap that only appears when you come to renew.

The good news is that these changes are practical. Once you know what to check, you can fix most of the gaps before the assessment starts.

Why this matters now

Cyber Essentials is no longer testing only the office network. It is testing how your organisation really works: the cloud platforms staff use every day, the devices that access business data, and the update process that keeps common attacks away.

According to the UK Government’s Cyber Security Breaches Survey 2025/2026, 43% of UK businesses identified a cyber breach or attack in the previous 12 months. The same survey

reported higher rates for small businesses at 46% and medium businesses at 65%. That matters because Cyber Essentials is designed to reduce the most common, avoidable risks – not just to produce a certificate.

IASME confirms that the updated Cyber Essentials requirements apply to new assessment accounts from 27 April 2026. The NCSC requirements document is version 3.3, known as the Danzell release. If your renewal is due in the second half of 2026, you need to check which question set applies and whether your current setup still fits.

The Honest Answer: Three Gaps That Could Fail Your Renewal

The Cyber Essentials 2026 changes UK businesses need to care about are not obscure technical details. They are the everyday systems staff use to get work done.

What is Cyber Essentials?

Cyber Essentials is the UK government-backed certification scheme that checks five basic cyber security controls: firewalls, secure configuration, security update management, user access control and malware protection. It is overseen by the National Cyber Security Centre and delivered through IASME certification bodies.

It does not prove your organisation is immune from cyber attacks. It does show that you have a recognised baseline in place against many common threats.

1. MFA is mandatory on cloud services

Under Cyber Essentials v3.3, authentication to cloud services must use multi-factor authentication where it is available. IASME is explicit: if a cloud service offers MFA and the organisation does not implement it, the assessment can fail automatically.

Multi-factor authentication means the second step beyond a password. It might be a code from an authenticator app, a push notification, a security key, a biometric check, or another approved method. It matters because stolen passwords are still one of the easiest ways into a business account.

The common mistake is assuming that MFA is complete because Microsoft 365 has a policy in place. That may be true for email, Teams and SharePoint, but it tells you nothing about the finance system, HR platform, CRM or shared social media login.

Typical missed systems include:

· Xero, QuickBooks, Sage and other finance platforms

· HR and payroll systems

· CRM tools such as HubSpot, Salesforce or Zoho

· Password managers

· Social media admin platforms

· Project management and document sharing tools

· Supplier portals accessed with a business email address

For a non-technical director, the question is not “do we have MFA?” The better question is “where do staff log in with business accounts, and is MFA enforced there too?”

2. Cloud services are fully in scope

The NCSC v3.3 requirements define cloud services as internet-accessed services, hosted on shared infrastructure, that are accessed through an account and store or process organisational data. The important point is simple: if your organisation’s data or services are hosted on cloud services, those services must be in scope.

This is a meaningful shift for businesses that previously treated Cyber Essentials as mainly about laptops, servers, routers and firewalls. Most SMB data now lives in SaaS platforms. Your accounts, payroll, CRM, case management, files and email may all sit outside your office, but they are still part of your business environment.

This does not mean you are responsible for every piece of infrastructure behind Microsoft 365, Xero or another cloud provider. The provider has responsibilities too. But you are responsible for the configuration you control, especially user access, MFA, account removal, secure settings and what happens when someone leaves.

An anonymised example: a small professional services firm had MFA enforced in Microsoft 365 and believed it was ready for Cyber Essentials. A quick review found three active leaver accounts in its CRM and a shared finance login with no MFA. No server was broken. No firewall was misconfigured. The gap was in the cloud tools nobody had put on the checklist.

3. Critical patches must be applied within 14 days

Cyber Essentials v3.3 says vulnerability fixes must be applied within 14 days of release where the vendor describes the issue as critical or high risk, or where the CVSS v3 score is 7 or above. If one update includes any critical or high-risk issue, that update falls inside the 14-day rule.

This applies across in-scope devices and software, including:

· Windows and macOS updates

· Mobile devices that access business data

· Browsers such as Chrome, Edge, Firefox and Safari

· Adobe, Java and other installed applications

· Router, firewall and other network device firmware

The issue for many SMBs is not willingness. It is visibility. Someone may believe updates are automatic, but no one can show whether all laptops, mobiles and third-party applications were patched inside the window.

There is also a timing problem in 2026. Microsoft states that support for Windows 10 ended on 14 October 2025. Devices still running Windows 10 without Extended Security Updates need

special attention, because unsupported software creates a Cyber Essentials risk as well as an operational one.

Cyber Essentials does not require an enterprise security team. It does require a repeatable process and evidence that the process is working.

The Other Changes Worth Checking

MFA, cloud scope and patching are the areas most likely to catch SMBs out. They are not the only changes that matter.

Password rules are more practical

The Danzell release reflects modern password guidance. Where MFA is in place, password requirements can be simpler. Where MFA is not available, passwords need to be stronger. Passwordless methods such as passkeys and FIDO2 security keys are recognised.

This is useful because it moves the conversation away from forced password changes every 90 days and towards stronger account protection. The goal is not to make staff remember more complex passwords. The goal is to stop easy account takeover.

Cyber Essentials Plus is less forgiving

Cyber Essentials Plus adds technical testing to the self-assessment. Under the updated approach, weak patching across a sample of devices can create a much bigger problem than one failed machine.

If you plan to go for Plus, do not wait until the test date to tidy up updates. Ask for a device and patch report first. The test should confirm that your controls are working, not become the moment you discover they are not.

The assessment questions have changed

If you usually copy last year’s answers and adjust a few dates, stop. The Danzell question set asks more clearly about cloud services, MFA and update management.

That is not a paperwork annoyance. It is the scheme catching up with the way small businesses now operate. Your previous answers may still be helpful, but they are not a safe shortcut.

But what about…?

“We passed last year. Does this really affect us?”

Yes, if you renew under the April 2026 requirements. Last year’s answers are useful background, but they should not be copied across without review. Cloud scope, MFA coverage and patch evidence need a fresh check.

“What if a cloud service offers MFA as a paid add-on?”

Treat it as a gap to resolve before assessment. IASME says MFA must be implemented for cloud services where it is available, whether it is free, included or paid. If a business-critical tool makes MFA difficult or expensive, that is now a risk decision, not just a licence decision.

“Are personal phones in scope?”

If a personal phone is only used for native calls, texts or an MFA app, it is usually out of scope. If it accesses organisational email, files or services, it may be in scope. That is why bring your own device arrangements need a clear policy.

“Can our IT provider handle this?”

They can help, but the organisation still owns the assessment answers. Ask your provider for evidence, not reassurance. A patch report and MFA coverage review are more useful than “yes, that should be fine.”

“How much does Cyber Essentials cost?”

IASME’s public FAQ says Cyber Essentials pricing starts from £320 plus VAT for micro-organisations and rises on a sliding scale to a maximum of £600 plus VAT for larger organisations. That is the assessment cost, not the total cost of getting ready. If you need MFA setup, device upgrades, patch reporting or Cyber Essentials Plus testing, budget more.

What Good Looks Like: A Five-Point Self-Audit

Use this checklist before you renew or start a new Cyber Essentials application.

1. Is MFA enabled for every Microsoft 365 user?

Check all users, not just administrators. Include shared mailboxes, dormant accounts, contractors and service accounts. If an account cannot use MFA, document why and review whether it should exist.

2. Do you use any cloud tools where MFA is not set up?

List every SaaS tool accessed with a business email address. Finance, HR, CRM and social media tools are the ones most often missed.

3. Who is responsible for applying software updates?

Name the person, provider or process. “Everyone updates their own laptop” is rarely enough unless you can prove it works.

4. Can you show patch evidence?

Ask for a report that shows device coverage, missing high-risk or critical updates, and any machines that have not checked in recently. A policy document is helpful, but evidence is better.

5. Does your Cyber Essentials scope match how the business works?

Check whether your scope includes Microsoft 365, accounting software, HR systems, CRM, cloud storage and any other platform that stores or processes business data.

If you cannot answer these five questions clearly, you are not ready to submit yet. That is not a disaster. It is exactly why readiness checks exist.

If this is where you are, here’s what to do next

Start with a simple inventory. List the devices, users and cloud services your organisation depends on. Then check MFA on each cloud service and ask for patch evidence across laptops, mobiles, servers and network equipment.

If you are not sure whether your organisation would pass today, IT Outcomes offers a straightforward Cyber Essentials readiness review. No sales pitch, no jargon. Just a practical check against the current requirements and a clear list of what needs fixing before you go into assessment.

You can also read more about our wider cybersecurity services for UK businesses.

IT Outcomes helps SMBs across Kent, London and the South East make IT simpler, safer and easier to manage. Our role is to give you a clear plan, so Cyber Essentials becomes a manageable business task rather than another confusing compliance deadline.