Cyber Essentials is a starting line, not a finish line

Cyber Essentials certifications rose by almost a fifth last year, according to the National Cyber Security Centre (NCSC) [1]. That's good news. Yet only 5% of UK businesses hold one [2].

The rules also got tougher in April. A cloud service that offers multi-factor authentication (MFA) without it switched on now fails the whole assessment. So does a critical update left for more than 14 days [3].

Here's what worries me more.

Many organisations, large ones included, treat the certificate as proof that they take security seriously. In practice, the self-assessment often covers a small, well-kept part of the estate. It's drawn tightly enough to pass, because the certificate is a condition of selling to the public sector. Everything outside that boundary goes unexamined.

When I hear "we have Cyber Essentials, so we've done cyber security", it tells me there's a gap in understanding.

Cyber Essentials checks five controls on the day of the assessment. It's a floor. It says nothing about how a firm manages risk, which suppliers hold its data, or whether anyone would notice an attacker inside.

Cyber security is never done. Systems, suppliers and attackers change every month, and the work has to follow them.

The new rules make a narrow scope harder to hide. A certificate covering only part of the business now reads "Partial Organisation" [4]. Anyone can look it up.

So check the scope before you rely on a supplier's certificate, and before you ask a customer to trust yours.

Cyber Essentials changes in 2026: MFA on every cloud service

Since April 2026, two things fail an assessment outright. One is a cloud service that offers multi-factor authentication (MFA) without it switched on for every user. The other is a high-risk or critical update left for more than 14 days [3]. A certificate that covers only part of the business is now marked "Partial Organisation" [4].

Cyber Essentials renewal: what to do before your next one

• Read your own certificate. What does the scope cover, and what does it leave out? If it says "Partial Organisation", can you explain why to a customer?
• List every cloud service the firm pays for, including tools one team bought on a card. Each one that offers MFA must have it switched on [3].
• Find the accounts nobody uses every day: the Microsoft 365 set-up account, emergency logins and supplier admin accounts. These are where MFA is usually missing.
• Ask your IT provider for the patching record. High-risk and critical updates must go on within 14 days of release [3].
• Treat the certificate as a state you keep all year, not a form you fill in once.

Do you need Cyber Essentials Plus?

Cyber Essentials is a self-assessment: you answer the questions and a certification body checks your answers. Cyber Essentials Plus covers the same controls, but an assessor also tests a sample of your devices, internet gateways and internet-facing servers [5]. The Plus audit must take place within three months of your basic certificate, and both last 12 months [5].

You need Plus when a customer or contract asks for it, or when your board wants independent proof rather than your own word. Either way, get the basic controls right across the whole firm first. A Plus audit only tests what's in scope.

Your IT provider or an adviser can prepare the evidence. The accountability for what the firm declares stays with its directors or partners.

Read more

Sources

1. [1]techUK, NCSC Annual Review: the state of the cyber nation, 4 November 2026. https://www.techuk.org/insights/news/ncsc-annual-review-the-state-of-the-cyber-nation
2. [2]Department for Science, Innovation and Technology and Home Office, Cyber security breaches survey 2025/2026, 30 April 2026. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
3. [3]IASME, Important update: changes to Cyber Essentials for April 2026, viewed 9 November 2026. https://iasme.co.uk/articles/important-update-changes-to-cyber-essentials-for-april-2026/
4. [4]IASME, Cyber Essentials question set: Danzell (question A2.2), 2026. https://iasme.co.uk/wp-content/uploads/sites/2/confluence/2653028559/CE-2026_Danzell-Question-Set-v16-3.pdf
5. [5]IASME, Cyber Essentials Plus, viewed 9 November 2026. https://www.iasme.co.uk/cyberessentials/cyber-essentials-plus/

All blog posts