Cybersecurity · 5 min read
Cyber Essentials Got Tougher in 2026 – Are You Ready for Renewal?
Ross Marshall
Founder & Director, IT Covered · 2 November 2026 · Updated 21 October 2026
Cyber Essentials is reviewed every year, and most years the changes are small. 2026 was different. Since late April, every new assessment has been marked against version 3.3 of the requirements, with a new question set known as Danzell.
If you certified before then, your next renewal will be the first one under the new rules. Here's what you need to know.
The Short Version
The scheme has moved from "do you have a policy for this?" to "can you show it's actually working?" Things that an assessor might once have let slide are now clear-cut passes or fails.
What's Changed
MFA on every cloud service. Multi-factor authentication used to be checked mainly on admin accounts and a few key services. Now it's expected on all cloud services that offer it — Microsoft 365, your accounting software, CRM, file sharing, the lot.
Cloud services are clearly in scope. For the first time, the requirements formally define what a cloud service is. If your business uses it to handle company data, expect it to be included.
Patching questions can now fail you outright. Key questions on keeping software updated have become automatic fails. Critical and high-risk updates still need applying within 14 days, and you need to be able to show that happens.
Cyber Essentials Plus is stricter. Once technical testing begins, you can no longer go back and change your self-assessment answers. Testing is also more thorough.
Who This Affects Most
Small businesses that grew up on a mix of apps, each with its own login, will feel this most. It's common to find a few services — an old Dropbox, a supplier portal, a payroll system — still running on a password alone.
Old devices are the other trap. Anything no longer receiving security updates, such as a Windows 10 PC without Extended Security Updates, is an automatic fail. (See our post on Windows 10 and the October 2026 deadline.)
How to Pass First Time
- List every cloud service your team uses. Ask around — you'll usually find more than you expect.
- Switch on MFA everywhere it's offered, starting with email and anything that holds customer or financial data.
- Check every device is supported and patched, including laptops people take home.
- Do a dry run before you book the assessment, especially for Cyber Essentials Plus.
Why Bother?
More contracts, tenders and insurers now ask for Cyber Essentials. More importantly, the five controls it checks stop the majority of everyday attacks.
How We Can Help
We're Cyber Essentials certified ourselves and guide clients through it every month, from gap analysis to sign-off. Book a free IT audit and we'll tell you exactly what stands between you and a pass under the new rules.
Written by
Ross Marshall
Founder & Director, IT Covered
Ross has over a decade of hands-on IT experience, from engineering to IT Director level. He founded IT Covered to give businesses the proactive, jargon-free IT support they deserve.
