CyberCQR Thinking · Compliance
Cyber Essentials since April 2026: the cloud accounts that fail you
Cyber Essentials still checks the same five controls. What changed in April 2026 is the marking. A cloud service that offers multi-factor authentication without it switched on now fails the whole assessment. So does a critical update left for more than 14 days. Most firms have MFA on the accounts their people use every day. The failures sit in the accounts nobody uses: the Microsoft 365 set-up account, emergency logins, a supplier's admin account and the tool one team bought on a card. This briefing explains the change and what a board should ask before renewal.
Summary
The point for boards. Cyber Essentials used to tolerate a few gaps as long as most controls were in place. It no longer does for MFA on cloud services or for 14-day patching. One forgotten admin account without MFA is now enough to fail. Treat the certificate as a state you keep all year, not a form you complete once. Your IT provider or an adviser can prepare the evidence, but the accountability for what the firm declares stays with its directors or partners.
What changed in April 2026?
The National Cyber Security Centre (NCSC) owns Cyber Essentials, and IASME delivers it. The requirements moved to version 3.3, with a new question set called Danzell. It applies to assessment accounts created after 27 April 2026 [8]. The five technical controls are the same: firewalls, secure configuration, security update management, user access control and malware protection.
The marking is stricter in four places:
- MFA on cloud services. Where a cloud service offers multi-factor authentication (MFA), whether free, built in, connected through another service or a paid option, it must be switched on. If it is not, the assessment fails [2].
- Updates within 14 days. High-risk and critical updates for operating systems, firmware and applications must be applied within 14 days of release. Missing that is now an automatic fail as well, not a minor finding [2] [9].
- Cloud services in scope. Version 3.3 defines cloud services and does not allow them to be left out of the assessment [3] [8]. Any service that holds or processes the firm's data counts, including tools bought by one team.
- Exclusions have to be explained. Where an assessment covers only part of the organisation, the applicant must describe what was left out, say why and show how it is kept separate [8]. The certificate then reads "Partial Organisation" [9].
The requirements also recognise passwordless sign-in, such as FIDO2 security keys and passkeys, as a way to meet the MFA requirement [3] [8].
Cyber Essentials Plus adds a technical audit to the self-assessment. Under the new question set, if that audit fails because software is unpatched, the basic Cyber Essentials certificate that goes with it is revoked [10].
The standard didn't get harder to understand. It got tougher to pass with gaps you hadn't noticed.
Why firms that thought they were fine are failing
Everyday staff accounts usually have MFA. The failures come from accounts and services outside daily use.
- The Microsoft 365 set-up account. The first account in every tenant is made a Global Administrator, often on an onmicrosoft.com address [4]. Many were created by a reseller years ago and never given MFA.
- Emergency accounts built to old advice. For years the advice was to exclude these from MFA. Microsoft now requires MFA for everyone signing in to its admin portals [5], and Cyber Essentials expects it on every account.
- Exemptions. Senior staff, service accounts and shared mailboxes excused "for now".
- Supplier and contractor accounts. Admin accounts set up for a provider or an installer and never reviewed.
- The long tail of cloud tools. File sharing, e-signature, payroll, marketing and AI tools signed up for with a work email. Each one is in scope, and each one with MFA available must have it on.
Our briefing Your Secure Score doesn't count the accounts nobody remembers covers these accounts in detail. The Microsoft breach disclosed in January 2024 began with exactly this kind of account: a legacy test account without MFA [6].
What Cyber Essentials is, and what it isn't
Cyber Essentials is a sound baseline against common, unsophisticated attacks. Many contracts, insurers and public sector buyers ask for it. It is one layer, assessed once a year. It does not cover how the firm governs risk, manages suppliers, detects an intruder or recovers from an attack. Defence in depth means each control has another behind it, so one failure does not leave the firm open.
| Control | What it does | What it does not cover | Read more |
|---|---|---|---|
| Firewalls | Limits what can reach the firm's devices from the internet | Cloud services reached from anywhere; connected building kit | Do you know what is connected to your network? |
| Secure configuration | Removes defaults and unneeded software and accounts | Settings that drift between assessments | You'll be sold 70 security tools |
| Security update management | High-risk and critical fixes within 14 days | Proving it to an insurer after an incident | The tick box that decides your claim |
| User access control | Accounts approved, admin rights limited, MFA on cloud services | Phishing-resistant sign-in; supplier and app access | Identity: ten must-do actions |
| Malware protection | Stops known malicious software running | Detecting an attacker using valid accounts; backups and recovery | Ransomware preparedness |
Table 1. CyberCQR's summary of the five controls [3] and the papers that cover the gaps between them.
Where Zero Trust fits
Zero Trust means no account, device or network is trusted just because it is "inside". The NCSC's Zero Trust principles begin with mapping your architecture and knowing every user, service and device identity [7]. The April 2026 changes push every certified firm towards both. MFA can't go on every cloud service until you have listed them. Nor can an account be protected until you know who owns it. Firms that use the renewal to build those two lists get more than a certificate: they get the foundation for the rest. Our article Understanding Zero Trust covers the wider model.
What we see in practice
Many organisations, large ones included, treat a Cyber Essentials certificate as proof that they take security seriously. In practice, the self-assessment often covers a small, well-kept part of the estate, drawn tightly enough to pass, because the certificate is a condition of selling to the public sector. Everything outside that boundary goes unexamined.
Cyber Essentials is not a guarantee of how an organisation manages risk. When we hear "we have Cyber Essentials, so we've done cyber security", it shows a gap in understanding. Cyber security is never done: systems, suppliers and attackers change every month, and the work has to follow them.
Version 3.3 makes a narrow scope harder to hide. A certificate that covers only part of the organisation now reads "Partial Organisation" [9], and anyone who looks it up can see that. Before you accept a supplier's certificate, or ask a customer to trust yours, check its scope.
Six questions before your next renewal
- What is in scope? Do we have a current list of every cloud service that holds our data, including those bought by one team, and who keeps it?
- Does the certificate cover the whole organisation? If ours reads "Partial Organisation", could we explain to a customer what was left out and why?
- Who is exempt? Which accounts are excused from MFA, and why?
- Who holds the keys? Who owns the Microsoft 365 set-up account and our emergency accounts, and when were they last tested?
- Can we prove 14 days? Do we have dated evidence that high-risk and critical updates are applied within 14 days, for every device and application in scope?
- What happens between assessments? Who checks that controls are still in place in month six, not just the week before renewal?
Conclusion
The April 2026 changes reward firms that know what they own. The work that gets a firm through renewal, a list of cloud services, an owner for every account and MFA everywhere, is the same work that stops the attacks behind most breaches. Our Top 10 actions turn it into a checklist, and our good practice guide gives your IT lead or provider the technical steps.
Glossary
| Term | Meaning |
|---|---|
| Cloud service | An online service, accessed through an account, that stores or processes the firm's data. |
| Cyber Essentials | The UK government-backed certification for five basic technical controls, run by IASME for the NCSC. |
| Cyber Essentials Plus | The higher level of Cyber Essentials, where an assessor tests a sample of the firm's systems as well as checking the self-assessment. |
| Danzell | The name of the Cyber Essentials question set used since April 2026, with version 3.3 of the requirements. |
| Defence in depth | Several layers of protection, so one failure does not leave the firm open. |
| FIDO2 security key | A small physical key for signing in that cannot be phished. |
| Global Administrator | The most powerful role in Microsoft 365 and Entra ID. |
| IASME | The organisation that delivers Cyber Essentials for the NCSC. |
| Multi-factor authentication (MFA) | Signing in with something beyond a password, such as an app prompt or a security key. |
| Scope | The devices, networks, accounts and services covered by an assessment. |
| Zero Trust | A security model in which no user, device or network is trusted by default; every request is checked. |
Table 2. Terms used on this page (alphabetical).
Further reading
From CyberCQR
- Cyber Essentials since April 2026: ten actions before renewal
- Your Secure Score doesn't count the accounts nobody remembers
- Finding and securing forgotten cloud accounts: a good practice guide
- Security standards, compliance frameworks and governance bodies
- Document library: every paper and tool
External
References
- [1]Department for Science, Innovation and Technology and Home Office, Cyber security breaches survey 2025/2026, 30 April 2026.
https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026 - [2]IASME, Important update: changes to Cyber Essentials for April 2026, viewed 9 November 2026.
https://iasme.co.uk/articles/important-update-changes-to-cyber-essentials-for-april-2026/ - [3]National Cyber Security Centre, Cyber Essentials: requirements for IT infrastructure, v3.3, April 2026.
https://www.ncsc.gov.uk/sites/default/files/2026-08/IT%20Requirements%20v3.3.pdf - [4]Microsoft Learn, Best practices for Microsoft Entra roles, viewed 7 November 2026.
https://learn.microsoft.com/entra/identity/role-based-access-control/best-practices - [5]Microsoft Learn, Planning for mandatory multifactor authentication for Azure and other admin portals, viewed 7 November 2026.
https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication - [6]Microsoft Security Response Center, Microsoft actions following attack by nation state actor Midnight Blizzard, 19 January 2024.
https://msrc.microsoft.com/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/ - [7]National Cyber Security Centre, Zero trust architecture design principles, viewed 7 November 2026.
https://www.ncsc.gov.uk/collection/zero-trust-architecture - [8]IASME, Upcoming changes to the Cyber Essentials scheme: April 2026 update, 3 November 2025.
https://iasme.co.uk/articles/upcoming-changes-to-the-cyber-essentials-scheme-april-2026-update/ - [9]IASME, Cyber Essentials question set: Danzell (questions A2.2, A6.4 and A6.5), 2026.
https://iasme.co.uk/wp-content/uploads/sites/2/confluence/2653028559/CE-2026_Danzell-Question-Set-v16-3.pdf - [10]IASME, Schedule 17: Assessment quality and audit process (Cyber Essentials certification bodies), section 7.1, viewed 9 November 2026.
https://iasme.co.uk/cyber-essentials/schedules/cb-schedule-17/
Security is the outcome, not a solution.
CyberCQR is a UK cyber security advisory practice. We prepare firms for Cyber Essentials and keep the baseline checked all year, so the certificate reflects what is really in place. We are not a certification body, so our advice is never tied to whether you pass.