All services Every engagement has a fixed, published price. Book a strategy call
Every Cyber Essentials change taking effect in April 2026, anchored to the v3.3 requirements and the Danzell question set: the MFA and 14 day patching auto-fail rules, cloud scope, certificate transparency, and the Cyber Essentials Plus tightening.
This guide covers every change to Cyber Essentials taking effect in April 2026, anchored to the actual scheme documents: the Cyber Essentials Requirements for IT Infrastructure v3.3 and the new Danzell question set. It is written by an IASME licensed certification body, which means our assessors will be marking against these rules, and we would rather you knew them before you submit than after you fail.
The short version. From 26 April 2026, Cyber Essentials gets an auto-fail policy: no multi-factor authentication on a cloud service that offers it, or high-risk security updates applied slower than 14 days, and the assessment fails outright regardless of everything else. Cloud services get a formal definition and can never be excluded from scope. Certificates become more transparent, listing every legal entity covered. Cyber Essentials Plus closes the loopholes around selective updating and after-the-fact answer changes. The new question set is called Danzell, published on 13 February 2026, and organisations with assessment accounts created before 26 April have six months to certify under the old rules.
The five technical controls have not changed. What has changed is how strictly they are marked, how scope is declared, and how Cyber Essentials Plus is audited. The Cyber Essentials changes 2026 brings fall into three groups: auto-fail marking rules, transparency duties, and a tightened Plus assessment.
| Change | What it means | How serious |
|---|---|---|
| MFA auto-fail | Multi-factor authentication must be enabled on every cloud service where it is available, whether free, included or paid. Missing MFA now fails the whole assessment | Auto-fail |
| Patching auto-fail (A6.4 and A6.5) | High-risk or critical security updates and vulnerability fixes must be installed within 14 days of release, for operating systems, router and firewall firmware, and applications | Auto-fail |
| Cloud services defined and always in scope | A formal definition of a cloud service is added, and cloud services storing or processing your data can never be excluded from scope | Scope rule |
| Scoping wording simplified | The qualifiers “untrusted” and “user-initiated” are removed. Exclusions must be justified and segregation explained | Scope rule |
| Legal entities on the certificate | Every legal entity in scope must be named with address and company number, viewable on the digital certificate platform | Transparency duty |
| Detailed scope descriptions | Certificates are no longer limited to a brief scope line. Full descriptions are published, and out-of-scope areas must be described privately to the assessor | Transparency duty |
| Director declaration extended | The signed declaration now acknowledges responsibility to maintain compliance throughout the certification period rather than just on assessment day | Governance duty |
| “Point in time” clarified | The point in time is the date the certificate is issued. Systems must be supported on that date | Clarification |
| Cyber Essentials Plus retest rule | Fail the device sample and the retest checks a new random sample as well. A second failure revokes the underlying certificate | Plus assessment |
| Self-assessment locked before Plus | Verified self-assessment answers must be finalised before Plus testing starts and cannot be adjusted afterwards | Plus assessment |
| Date | What happens |
|---|---|
| November 2025 | NCSC publishes the updated Requirements for IT Infrastructure, including the MFA auto-fail policy |
| 13 February 2026 | The new Danzell question set is published, replacing the previous set |
| 26 April 2026 | All assessment accounts created after this date are assessed under the v3.3 requirements and the Danzell question set |
| 26 October 2026 | End of the six month transition: organisations with assessment accounts created before 26 April must have certified under the old rules by now |
The transition rule matters for planning. An assessment account created before 26 April 2026 keeps the previous requirements for six months. That gives organisations a genuine choice about which rule set to certify under this year, which we come back to at the end of this Cyber Essentials update 2026 guide.
This is the change with teeth. Until now, weak answers on multi-factor authentication or patching could drag a submission down without necessarily sinking it. From April 2026, two areas are marked as automatic failures, no matter how good the rest of the submission is.
Multi-factor authentication on every cloud service that offers it. The Cyber Essentials MFA 2026 rule is blunt: if a cloud service you use supports MFA, whether free, included in your plan or available as a paid option, it must be switched on. An organisation that has not enabled it fails the assessment automatically. Given that most business cloud services now offer MFA, the practical reading is: MFA everywhere, for everyone, including directors who dislike the extra step. The accounts most worth protecting belong to the people most likely to ask for an exception.
Security updates within 14 days, now as named auto-fail questions. Two questions in the Danzell set are designated auto-fail. Question A6.4 asks whether all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware are installed within 14 days of release. Question A6.5 asks the same for applications, including associated files and extensions. Answer either honestly in the negative and the assessment fails, regardless of performance everywhere else. The Cyber Essentials patching 2026 position is therefore simple: 14 days is not a target, it is the line.
Why the hard line? The scheme’s operators review breach investigations every year, and delayed critical updates and missing MFA sit behind a large share of the incidents that hit smaller organisations. The auto-fail policy simply stops the two most exploited weaknesses from being averaged away by good answers elsewhere.
The v3.3 requirements add a formal definition: a cloud service is an on-demand, scalable service, hosted on shared infrastructure and accessible via the internet, accessed via an account, that stores or processes data for your organisation. Alongside the definition comes the rule that matters: if your organisation’s data or services are hosted on cloud services, those services must be in scope. Cloud services cannot be excluded.
For most SMEs this is less frightening than it sounds, because the everyday estate is exactly this: Microsoft 365 or Google Workspace, an accounts platform, a CRM, file storage. The change does not demand new technology. It demands that you know which cloud services the business uses, that each one is declared, and that MFA is on for all of them, which loops straight back to the auto-fail rule above. The organisations with work to do are the ones where staff have quietly signed up to tools nobody catalogued.
Two scoping qualifiers that generated years of confusion, “untrusted” and “user-initiated” internet connections, are removed from the requirements entirely. In their place come duties that make scope claims checkable. Organisations must justify any exclusion from scope and explain how excluded networks are segregated from in-scope systems. Certificates gain room for a full scope description instead of one cramped line, published on the digital certificate platform. Out-of-scope areas must be described to the assessor, though that part stays private. And every legal entity covered by the certification must be named, with address and company number, visible on the digital platform, with individual certificates available per entity for a small additional charge.
The intent is transparency for the people who rely on certificates: buyers, insurers and frameworks checking a supplier. It has been too easy to certify a convenient corner of a group and let the certificate imply more. From April 2026, what a certificate covers is written on it, in detail, with company numbers.
Two governance changes deserve board attention. First, the signed declaration that accompanies the verified self-assessment is extended: the board member or director signing now explicitly acknowledges the organisation’s responsibility to maintain compliance with all Cyber Essentials controls throughout the certification period rather than merely on the day of assessment. Second, the scheme clarifies what “point in time” means: it is the date the certificate is issued, and systems must be supported on that date.
Read together, these close the gap between certificate and reality. A certificate is no longer something IT obtained once and everyone forgot. It is a standing commitment a named director has signed for. If you brief your board once about Cyber Essentials 2026, brief them on this: the signature now carries a twelve month promise, so the controls need an owner who keeps them true between assessments.
The Cyber Essentials Plus requirements change in two ways for 2026, and both close loopholes that audits exposed.
| The old loophole | The 2026 rule |
|---|---|
| Organisations that failed the device sample sometimes fixed only the sampled devices, passed the retest, and left the rest of the estate vulnerable | If the initial random sample fails, the retest checks the original sample plus a new random sample. A second failure revokes the underlying verified self-assessment certificate |
| Self-assessment answers could be quietly adjusted after Plus testing revealed inconvenient facts | The verified self-assessment must be completed and finalised before Plus testing starts, and cannot be changed afterwards. The scheme’s terms and conditions are updated to say so explicitly |
The message behind both rules is the same: Cyber Essentials Plus verifies the whole estate you certified rather than a rehearsed corner of it. For organisations that treat the controls as their normal way of operating, nothing changes except the paperwork. For anyone who passed by patching twelve laptops the night before the audit, 2026 is the year that stops working, and the price of trying is now the certificate itself.
Application development. The section previously called “web applications” is renamed “application development” and now points to the UK Government’s Software Security Code of Practice. Publicly available commercial web applications are in scope by default. Bespoke and custom components remain out of scope for the assessment.
Backups moved up. Backups are still not a marked control, but the guidance is repositioned earlier in the requirements document to underline the point every ransomware incident makes eventually: recovery depends on backups that exist and restore.
Passwordless gets first-class treatment. The user access control section now highlights passwordless authentication, such as passkeys, as a more secure alternative to passwords. If you are modernising authentication anyway for the MFA rule, it is worth considering going straight to passkeys where your platforms support them.
The Cyber Essentials UK requirements for 2026 reward organisations that prepare early, and the preparation is unglamorous. Four moves cover most of it.
First, switch on MFA everywhere, this week. List every cloud service the business uses, check whether each offers MFA, and enable it for every user with no exceptions. This is the single change most likely to fail an unprepared SME after April, and it usually costs nothing but grumbling.
Second, measure your patch latency. Find out how long high-risk updates take to land on your operating systems, firewalls, routers and applications. If the honest answer is longer than 14 days, fix the process now: turn on automatic updates where you can, and give someone the job of chasing the rest.
Third, map your cloud services and legal entities. Build the list of cloud services that will now always be in scope, and the list of legal entities the certificate must name, with company numbers. Both lists take an afternoon and remove the two most common causes of scoping delay.
Fourth, decide your timing deliberately. Which brings us to the question everyone asks.
If your renewal falls in early 2026 and your estate already runs MFA everywhere with fast patching, the change of question set barely matters: certify whenever suits you, because you would pass under either. If you have known MFA gaps or slow patching, there is a genuine tactical choice. Creating your assessment account before 26 April keeps you on the previous requirements for up to six months, buying time to fix the estate properly. Use the time to fix rather than to defer: the auto-fail rules arrive at your next renewal regardless, and the controls they enforce are ones your insurer and your customers already expect. Certifying under Danzell with the estate genuinely tidy is worth more, to you and to anyone checking your certificate, than squeezing through under the old rules.
Intelance is an IASME licensed certification body, so our assessors mark against these rules directly. Cyber Essentials certification costs the official fee of £320 to £600 + VAT by organisation size, with a guided option at £950 + VAT where our assessors prepare the submission with you and tell you exactly what to fix for the 2026 rules. Cyber Essentials Plus is £1,150 + VAT, fixed, in one to three weeks, and we check readiness before the audit because under the 2026 rules a second failure costs you the certificate. Full pricing detail, including what everyone else charges, is in our Cyber Essentials cost guide.
From 26 April 2026, missing multi-factor authentication on any cloud service that offers it, or high-risk security updates applied slower than 14 days, automatically fail the assessment. Cloud services are formally defined and always in scope, certificates list every legal entity covered, and Cyber Essentials Plus gains stricter retest rules.
The new rules apply to all assessment accounts created after 26 April 2026. Organisations with accounts created before that date have six months to certify under the previous requirements.
Danzell is the new Cyber Essentials question set published on 13 February 2026, accompanying version 3.3 of the Requirements for IT Infrastructure. It includes the new auto-fail questions on multi-factor authentication and 14 day security updates.
The five controls are unchanged, but the marking is stricter. Organisations that already run MFA everywhere and patch within 14 days will notice little difference. Organisations relying on partial MFA or slow patching will now fail automatically rather than scraping through.
Certain questions now fail the entire assessment on their own, regardless of every other answer: multi-factor authentication missing from a cloud service that offers it, and high-risk or critical updates not installed within 14 days (questions A6.4 and A6.5).
No. Version 3.3 defines a cloud service and states that cloud services storing or processing your organisation’s data must be in scope. The practical task is knowing which cloud services the business uses and enabling MFA on all of them.
If the initial device sample fails, the retest now checks a new random sample as well as the original one, and a second failure revokes the underlying certificate. Self-assessment answers must also be finalised before Plus testing begins and cannot be adjusted afterwards.
Only if your assessment account was created before 26 April 2026, and only for six months after that date. After the transition, all assessments use the Danzell question set and the v3.3 requirements.
Yes, wherever the service makes it available, whether free, included or paid. From April 2026, a cloud service with MFA available but not enabled is an automatic failure.
Written by Emmanuel Olatunji, Chief Enterprise Architecture Partner at Intelance, an IASME licensed certification body for Cyber Essentials and Cyber Essentials Plus. Based on the NCSC Requirements for IT Infrastructure v3.3 and IASME’s February 2026 scheme announcement. Last reviewed 8 July 2026.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a licensed assessor. You leave knowing which route applies to you, what it costs and what to do first.
Talk to a senior adviser
