CyberCQR Top 10 · Compliance
Cyber Essentials since April 2026: ten actions before renewal
Ten actions a UK board can require so the firm passes Cyber Essentials under the April 2026 rules, and stays compliant between assessments. Three set the scope. Four close the gaps that now fail an assessment outright. Three keep the certificate true all year.
Summary
The point for boards. Under the April 2026 rules, one cloud service without MFA, or one critical update left past 14 days, is enough to sink the whole assessment. Most of the actions below are lists, decisions and settings, not purchases. Your IT provider or an adviser can do the work; the accountability for what the firm declares stays with its directors or partners. Our briefing Cyber Essentials since April 2026: the cloud accounts that fail you explains the change.
What do the rules say?
- Cyber Essentials v3.3. Five controls: firewalls, secure configuration, security update management, user access control and malware protection. Cloud services are defined and cannot be excluded from scope [3].
- Marking since April 2026. MFA must be on wherever a cloud service offers it, including paid options, and high-risk or critical updates must be applied within 14 days. Either gap fails the assessment [2].
- Microsoft. MFA has been required for its admin portals since October 2024 [5]. Security defaults switch on MFA for everyone at no extra cost where Conditional Access isn't licensed [6].
The ten actions
Actions 1 to 3 set the scope. Actions 4 to 7 close the gaps that now fail outright. Actions 8 to 10 keep the certificate true between assessments.
1. Name one director or partner who owns the certificate
Why it matters. The certificate is a statement the firm makes about itself. Someone at board level should know what it covers and be confident it is still true.
What to do.
- Name the owner and put the renewal date in the board calendar six months ahead.
- Agree that the IT provider prepares the evidence and the owner signs off what is declared.
- Report on actions 2 to 10 at least twice a year.
2. List every cloud service, including the ones IT didn't buy
Why it matters. Cloud services cannot be excluded from scope [3]. A service you have not listed is a service you have not checked for MFA.
What to do.
- Ask finance for every software subscription paid by invoice or card.
- Ask each team which online tools they use with a work email: file sharing, e-signature, payroll, marketing, accounting and AI tools.
- Record for each: owner, what data it holds, whether MFA is available and whether it is on.
3. List every device and network in scope
Why it matters. Devices that connect to the internet are in scope, including home-working laptops and connected kit in the office [3]. Unsupported software must be removed or isolated.
What to do.
- Reconcile the device list with sign-in records, so personal and forgotten devices show up.
- Note anything past its support date and the plan for it.
- Check CCTV, door access and other building systems. See Connected devices in the office.
4. Switch on MFA for every account on every cloud service
Why it matters. This is the change that fails most firms. MFA must be on where it is available, even if it costs extra [2]. Fewer than half of UK businesses have two-factor authentication in place [1].
What to do.
- In Microsoft 365, switch on security defaults if you have no Conditional Access [6].
- Work through the list from action 2, service by service, and record the date MFA was enforced.
- Remove exemptions for senior staff and shared accounts. Our case study Simpler and stronger shows how one firm did it.
5. Find the admin accounts nobody uses day to day
Why it matters. The Microsoft 365 set-up account, emergency accounts and supplier admin accounts are the ones most often missing MFA. The first account in every tenant is made a Global Administrator automatically [4].
What to do.
- List every Global Administrator and cut the number to fewer than five [4].
- Give administrators separate accounts used only for admin work, as Cyber Essentials expects [3].
- Follow Cloud accounts nobody owns: ten actions for the full list.
6. Set up emergency access that meets the rules
Why it matters. Emergency accounts built to older advice, with a long password and no MFA, now fail Cyber Essentials and may not work in Microsoft's admin portals [5].
What to do.
- Keep two cloud-only emergency accounts protected by FIDO2 security keys, which the v3.3 requirements recognise for MFA [3].
- Alert on every use and test them at least every 90 days [7].
- Our good practice guide, section 2, gives the steps.
7. Prove 14-day patching with dated evidence
Why it matters. Missing the 14-day window for high-risk or critical updates is now an automatic fail [2]. Insurers ask the same question after an incident.
What to do.
- Switch on automatic updates for operating systems and applications wherever possible.
- Keep a monthly report showing release date, install date and exceptions, for devices and firmware.
- Read The tick box that decides your claim for how insurers test this.
8. Check the baseline monthly, not yearly
Why it matters. Settings drift. A new tool gets bought, an exemption is granted, an update stalls. An annual check finds it eleven months late.
What to do.
- Review new cloud services, MFA coverage, admin accounts and patch reports every month.
- Use Microsoft Secure Score as one input, but record why any action is marked resolved by hand [8].
- Bring exceptions to the owner from action 1.
9. Add new services and suppliers through one front door
Why it matters. Most out-of-scope services and unprotected accounts arrive one at a time, through a card payment or a contractor.
What to do.
- Require MFA and an owner before any new cloud service is paid for.
- Give suppliers named accounts with MFA, limited to the access they need, removed when the work ends.
- Restrict which apps staff can connect to company data. See Third-party and supply chain ransomware.
10. Treat the certificate as one layer, not the finish line
Why it matters. Cyber Essentials checks five technical controls. It says nothing about detection, recovery, suppliers or board oversight. Defence in depth means each of those has its own layer.
What to do.
- Check that backups are tested and isolated. See Ransomware preparedness: ten actions.
- Ask how the firm would spot an attacker using a valid account.
- Report coverage, not just compliance. See All green, still exposed.
How the actions support each other
Scope comes first because every later action depends on it: you cannot enforce MFA on a service you haven't listed. Actions 4 to 7 are what the assessor checks. Actions 8 to 10 are what keeps the answer true in month six. The same lists, of cloud services and of accounts with owners, are the opening two of the NCSC's Zero Trust principles [9]. A firm that builds them for Cyber Essentials has also started on Zero Trust. Our identity Top 10 shows the next steps.
Questions for the board
- Who owns our certificate, and when is the next renewal?
- Do we have a current list of every cloud service in use?
- Is MFA on for every account on every one of them, with no exemptions?
- Can we show dated evidence of 14-day patching?
- Who checks the baseline between assessments?
Glossary
| Term | Meaning |
|---|---|
| Cloud service | An online service, accessed through an account, that stores or processes the firm's data. |
| Conditional Access | Microsoft's rules that decide whether a sign-in is allowed. Needs Entra ID P1 or higher. |
| Defence in depth | Several layers of protection, so one failure does not leave the firm open. |
| FIDO2 security key | A small physical key for signing in that cannot be phished. |
| Global Administrator | The most powerful role in Microsoft 365 and Entra ID. |
| Multi-factor authentication (MFA) | Signing in with something beyond a password, such as an app prompt or a security key. |
| Scope | The devices, networks, accounts and services covered by an assessment. |
| Security defaults | A free Microsoft setting that requires MFA and blocks older sign-in methods. |
Table 1. Terms used on this page (alphabetical).
Further reading
From CyberCQR
- Cyber Essentials since April 2026: the cloud accounts that fail you
- Cloud accounts nobody owns: ten actions for boards
- Finding and securing forgotten cloud accounts: a good practice guide
- Shrinking the PCI zone: card payment compliance by isolation
- Document library: every paper and tool
External
References
- [1]Department for Science, Innovation and Technology and Home Office, Cyber security breaches survey 2025/2026, 30 April 2026.
https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026 - [2]IASME, Important update: changes to Cyber Essentials for April 2026, viewed 9 November 2026.
https://iasme.co.uk/articles/important-update-changes-to-cyber-essentials-for-april-2026/ - [3]National Cyber Security Centre, Cyber Essentials: requirements for IT infrastructure, v3.3, April 2026.
https://www.ncsc.gov.uk/sites/default/files/2026-08/IT%20Requirements%20v3.3.pdf - [4]Microsoft Learn, Best practices for Microsoft Entra roles, viewed 7 November 2026.
https://learn.microsoft.com/entra/identity/role-based-access-control/best-practices - [5]Microsoft Learn, Planning for mandatory multifactor authentication for Azure and other admin portals, viewed 7 November 2026.
https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication - [6]Microsoft Learn, Security defaults in Microsoft Entra ID, viewed 7 November 2026.
https://learn.microsoft.com/entra/fundamentals/security-defaults - [7]Microsoft Learn, Manage emergency access admin accounts in Microsoft Entra ID, viewed 7 November 2026.
https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access - [8]Microsoft Learn, Assess your security posture with Microsoft Secure Score, viewed 7 November 2026.
https://learn.microsoft.com/defender-xdr/microsoft-secure-score-improvement-actions - [9]National Cyber Security Centre, Zero trust architecture design principles, viewed 7 November 2026.
https://www.ncsc.gov.uk/collection/zero-trust-architecture
Security is the outcome, not a solution.
CyberCQR is a UK cyber security advisory practice. We prepare firms for Cyber Essentials and check the baseline all year, so the certificate stays true. We are not a certification body, so our advice is never tied to whether you pass.