Cyber Essentials 2026 — the rules have changed

The April 2026 update to Cyber Essentials is the most significant revision the scheme has seen. If you hold — or are considering — Cyber Essentials certification, here is what changed and why it matters.

What changed

Multi-factor authentication is now mandatory for all cloud services. If your business uses Microsoft 365, Google Workspace, or any other cloud platform, MFA must be enabled for every user account. No exceptions.

Home working environments are in scope. Devices used for work and the routers they connect through must now meet Cyber Essentials requirements. This is a significant expansion from previous guidance, which only covered business premises.

Director-level sign-off is required. A company director or board-level representative must personally confirm that the organisation will maintain all required security controls throughout the entire certification period. This is no longer a purely technical exercise — it is a formal governance commitment.

Password controls must be enforced technically. Minimum password lengths and complexity rules must now be enforced by technical controls, not simply documented in policy.

Certification unlocked

Only 5% of UK businesses currently hold Cyber Essentials certification. For those that do, the benefits go beyond security:

  • Free £25,000 cyber insurance for firms with turnover under £20m
  • Mandatory requirement for UK government contracts involving personal data or IT services
  • Supply chain necessity — the government’s Cyber Resilience Pledge encourages signatories to work only with Cyber Essentials-certified suppliers
  • Many local authorities and NHS bodies now expect certification from their suppliers even where not strictly mandated

The five technical controls

Cyber Essentials covers five controls that prevent approximately 80% of common cyber attacks:

  1. Firewalls and secure configuration
  2. Secure configuration of devices and software
  3. User access controls
  4. Malware protection
  5. Patch management

How we can help

We guide businesses through Cyber Essentials certification — from the initial assessment to implementation and the certification application. With the 2026 update broadening the scope, having an experienced partner makes the process straightforward.

Talk to us about Cyber Essentials certification.