Cyber Essentials 2026: What’s Changing and How to Prepare
Cyber threats continue to evolve, and the UK’s Cyber Essentials scheme is being updated to ensure organisations maintain strong baseline security. The next revision, version 3.3 of the Requirements for IT Infrastructure, comes into effect on 27 April 2026, and will apply to all assessments started after that date. Businesses beginning an assessment before then can continue under the current version, provided they complete it within six months.
For organisations that rely on Cyber Essentials to demonstrate cyber hygiene to customers, insurers and supply‑chain partners, understanding the upcoming changes is essential.
The Key Changes for 2026
Clearer scope for cloud services and devices
The definition of a cloud service is being simplified: any online system that stores or processes your organisation’s data is now firmly in scope. This includes platforms such as Microsoft 365, Google Workspace, CRM tools and cloud storage. Device scoping is also changing. Any internet‑connected device will be included, laptops, desktops, tablets and smartphones. Previous wording around “untrusted networks” has been removed to make this clearer.
Refinements to specific control areas
The previous “Web Applications” section is now titled “Application Development”, aligning with the UK Government’s Software Security Code of Practice. Public‑facing apps will always be in scope; internal‑only tools may not be.
Mandatory MFA across all cloud services
Multi‑factor authentication (MFA) will become compulsory wherever it is available. If a cloud platform offers MFA, even as an optional or paid feature, it must be enabled. Failure to activate MFA will result in an automatic assessment fail. This shift highlights MFA as a minimum expected protection against account compromise.
Backup requirements have been brought forward in the standard to emphasise the importance of recovery and continuity, while user access guidance now promotes modern authentication methods such as passkeys, biometrics and passwordless sign‑in.
Why These Updates Matter
The 2026 changes strengthen core areas that directly impact cyber resilience. SMEs using cloud services will need to verify that all platforms meet the new MFA requirement. Supply‑chain expectations are also likely to tighten, making early preparation beneficial. Clearer scope rules mean assessors will expect better system inventories and documentation, helping prevent delays at certification.
Get Support With Cyber Essentials
Sota’s cyber security specialists can help you review your systems, prepare for the 2026 requirements and guide you through certification or renewal.
If you’d like tailored support or advice, get in touch with Sota’s expert team today