From 27 April 2026, every new Cyber Essentials assessment is judged against version 3.3 of the NCSC’s Requirements for IT Infrastructure, answered through a new question set called Danzell, and two failings become automatic fails: leaving multi-factor authentication switched off on a cloud service that offers it, and missing the 14-day window for high-risk or critical security updates. The five controls have not changed. What has changed is how much discretion an assessor has when your evidence falls short, and for regulated firms renewing this spring or summer that is the part that matters.
Cyber Essentials is the UK government-backed baseline certification, run by the National Cyber Security Centre (NCSC) with IASME as its delivery partner, covering five technical controls: firewalls, secure configuration, user access control, malware protection and security update management. Cyber Essentials Plus adds independent technical testing of the same controls. Our February guide covers the scheme itself; this article covers what is different from 27 April.
What exactly changes on 27 April 2026?
IASME announced the 2026 update on 12 February 2026 and published the Danzell question set, which replaces the previous Willow set, on 13 February 2026. The changes apply to all assessment accounts created on or after 27 April 2026. The main points are these.
- MFA on cloud services becomes an automatic fail. IASME’s wording is that multi-factor authentication “is a mandatory requirement for all cloud services where it is available”. IASME notes that the NCSC first introduced this auto-fail policy in its November 2025 updates. It applies to every user account, not only administrators.
- The 14-day update rule is now tested directly. Two new questions, A6.4 and A6.5, ask whether high-risk or critical security updates and vulnerability fixes are installed within 14 days of release across operating systems, firmware and applications. Missing the window is an automatic fail.
- Cloud services are defined. v3.3 defines a cloud service as “an on-demand, scalable service, hosted on shared infrastructure, and accessible via the internet”. That definition makes it harder to argue a SaaS platform out of scope.
- Cyber Essentials Plus sampling is stricter. An organisation can no longer fix only the devices the assessor sampled. A failed retest now includes newly selected random devices, so remediation has to be organisation-wide.
- Scope is more transparent. Scope descriptions are no longer length-limited, out-of-scope areas must be recorded, legal entities must be identified with company numbers, and separate certificates can be issued per entity.
- The board declaration is wider. The director or board member signing the declaration now acknowledges responsibility for maintaining compliance throughout the certification period, not just on the day of assessment.
Why does the MFA auto-fail matter more for regulated firms?
Because regulated firms run more cloud services than they usually realise, and each one is now a potential automatic fail. A typical law firm, wealth manager or clinic runs Microsoft 365, a practice or case management platform, an accounting system, an e-signature tool, a client portal, a payroll provider and a document exchange service. Each of those is a cloud service under the v3.3 definition, and most offer MFA.
The failure we see most often is not the email platform, which is usually well configured, but the line-of-business platform administered by an operations manager rather than IT. MFA may be available but switched off because a partner complained, or enabled for administrators only. Commentary from certification bodies reads “available” broadly, including MFA offered only on a higher subscription tier. If a service genuinely offers no MFA at all, that is a different case, and it should be documented with the vendor’s own statement.
What does the 14-day rule look like as evidence?
It looks like a complete device and software inventory, matched against update reports with dates on them. The 14-day window has always been in the requirements; the difference is that the assessor will now ask directly and an honest “no” ends the assessment.
Three areas tend to fail:
- Firmware. Firewalls, routers, Wi-Fi access points and storage devices are frequently patched once a year or never, because nobody owns them.
- Third-party applications. PDF readers, browsers outside the corporate deployment, Java runtimes and line-of-business clients that update separately from the operating system.
- Devices outside management. Home-working laptops, a reception PC or a meeting-room device that is not enrolled in the organisation’s management tooling and therefore never appears in a patch report.
Patch management is the process of identifying, testing and installing vendor security updates within a defined time. Under v3.3, that time is 14 days for anything rated high-risk or critical, and the organisation needs records to prove it.
How does this connect to contracts and insurance?
Directly. Cyber Essentials has been mandatory since 2014 for central government contracts that involve handling certain sensitive and personal information, and many larger buyers now require it of their own suppliers. The NCSC also notes that organisations certifying their whole organisation with under £20 million annual turnover receive automatic cyber liability insurance as part of certification (NCSC, 14 October 2025). A certificate that lapses because a renewal fails on an auto-fail question has commercial consequences well beyond the IT team.
There is also a regulatory angle. The ICO treats basic controls such as MFA and timely patching as part of the “appropriate technical and organisational measures” required by UK GDPR Article 32. A failed Cyber Essentials assessment is not a regulatory finding, but it is documentary evidence that a known control was missing, and that is not a document a regulated firm wants to have created.
What to do this quarter
- List every cloud service in use, including line-of-business platforms owned outside IT, and record whether MFA is available and enforced for all users.
- Enable MFA wherever it is available, starting with services that hold client or patient data. Record the vendor’s statement for any service that genuinely does not support it.
- Produce a patch report covering operating systems, applications and firmware, and test it against the 14-day window for the last three months.
- Assign a named owner for network device firmware.
- Check when your current certificate expires. If renewal falls after 27 April 2026, plan for v3.3, not the old question set.
- Brief the director who will sign the declaration on what they are now acknowledging.
How Rhentech helps
A cybersecurity audit is the most reliable way to find the auto-fail gaps before an assessor does: we test MFA coverage across the cloud estate, check patch evidence against the 14-day window and map the scope the way v3.3 will expect it to be described. Where the gaps come from the absence of day-to-day ownership, our managed IT and cybersecurity service keeps the controls in place between assessments so that renewal is a formality rather than a project.
If your renewal falls after 27 April, book a free initial consultation and we will talk through your current position and whether a readiness review makes sense before you submit.
Frequently asked questions
When do the Cyber Essentials v3.3 changes take effect?
They apply to every Cyber Essentials assessment account created on or after 27 April 2026. Assessments started before that date continue under the previous question set. IASME announced the changes on 12 February 2026 and published the Danzell question set on 13 February 2026.
Is MFA now mandatory for Cyber Essentials?
Yes, for cloud services where it is available. IASME’s announcement states that multi-factor authentication is a mandatory requirement for all cloud services where it is available, and not enabling it is an automatic fail under v3.3. It applies to standard user accounts as well as administrators.
Has the 14-day patching rule changed?
The 14-day window for high-risk and critical updates has long been part of Cyber Essentials. What changes in v3.3 is enforcement: two new questions, A6.4 and A6.5, ask directly about it, and failing to meet it is an automatic fail covering operating systems, firmware and applications.
Do the five Cyber Essentials controls change?
No. Firewalls, secure configuration, user access control, malware protection and security update management remain the five controls. The changes tighten how they are evidenced, scoped and assessed rather than adding new controls.
Sources
- IASME, Important Update: Changes to Cyber Essentials for April 2026, 12 February 2026.
- NCSC, Cyber Essentials overview, accessed March 2026.
- NCSC, UK experiencing four ‘nationally significant’ cyber attacks every week, 14 October 2025.
- UK GDPR Article 32, security of processing.
Reviewed 20 October 2026.