What changed in Cyber Essentials in April 2026?
Cyber Essentials changed in April 2026. Two of the changes matter to almost every small organisation, whether or not you ever plan to get certified.
What Cyber Essentials is
Cyber Essentials is a government-backed scheme run with the NCSC. The NCSC calls it the minimum standard of cyber security the Government recommends for organisations of all sizes. It covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus checks the same controls but adds hands-on technical testing.
You might meet it because a funder, council or larger client asks whether you hold it. The NCSC notes that a growing number of organisations require suppliers to be certified before they can bid for work.
The two changes that matter most
The requirements moved to version 3.3 in April 2026, with a new question set called Danzell. IASME, which runs certification, gave accounts opened before the change six months to certify under the old version. That window has now closed, so anyone certifying or renewing today is assessed against the new rules.
1. Multi-factor authentication on every cloud account. The v3.3 requirements say that signing in to cloud services must always use multi-factor authentication (two-step sign-in). That means every user account, not just administrators. Think Microsoft 365, Google Workspace, online file storage and web-based email. Missing it is now an automatic fail.
2. Critical updates within 14 days. High-risk and critical security updates for operating systems, firmware and applications must be installed within 14 days of release. The requirements define these as updates fixing a flaw with a CVSS v3 score of 7 or above, or ones the vendor labels critical or high-risk. Missing this is also an automatic fail.
Unsupported software must go too. Windows 10, for example, reached end of support on 14 October 2025. A computer still running it without Extended Security Updates counts as unsupported.
Worth doing even without a certificate
Most small organisations never get certified, and that's fine. But these two habits cost little and close the doors attackers try first. With two-step sign-in, a stolen password alone isn't enough to get in. With automatic updates, known holes get fixed before anyone has to remember.
A one-afternoon checklist
- List every online service you sign in to: email, file storage, banking, accounts software, booking system, social media and website hosting.
- For each one, check that two-step sign-in is switched on for every person, not just you.
- Start with email. Whoever controls your email can usually reset every other password.
- On every laptop, tablet and phone, turn on automatic updates for the operating system and apps.
- Check your router for firmware updates, and change any default admin password.
- Find any device that no longer gets security updates. Plan to upgrade, replace or retire it.
- Put a reminder in the diary to repeat this every three months.
A worked example
Take a made-up community centre with four staff and a volunteer treasurer. They use Microsoft 365, online banking and a shared office laptop.
Two staff already sign in with an authenticator app. The other two, and the treasurer, use only a password. Under v3.3, that alone would fail the assessment. Turning on two-step sign-in for the remaining three is a short job for each person, done at their desk.
The shared laptop still runs Windows 10 with no Extended Security Updates. That would fail too, so it needs upgrading or replacing. Everything else passes once automatic updates are confirmed on each device.
If a funder or client asks for Cyber Essentials, read the questions before you pay for anything. IASME publishes the self-assessment questions free, so you can prepare your answers first.
Sources
- NCSC: Cyber Essentials requirements for IT infrastructure v3.3
- IASME: Changes to Cyber Essentials for April 2026
- NCSC: About Cyber Essentials
- Microsoft: Windows 10 end of support
Related
← Why are our emails going to spam? SPF, DKIM and DMARC explained