The Cyber Essentials 2026 changes give MSPs a reason to revisit how they prepare clients for certification. The five core controls remain the same, but updated assessment marking and clearer guidance make it important to check how clients apply those controls in practice.
For example, offering MFA does not mean users actually have to use it. Similarly, a patching service on a client’s agreement does not prove that every relevant device receives updates on time.
This guide explains the main changes and provides a practical checklist for reviewing client readiness. It also shows how to turn technical findings into recommendations clients can understand and act on.
When did the Cyber Essentials 2026 changes take effect?
IASME’s February 2026 update states that the changes apply to assessment accounts created after 26 April 2026. Applicants with earlier active accounts have six months to complete certification under the previous requirements.
Therefore, confirm each client’s account creation date and applicable assessment version with their Certification Body. The transition relates to assessment accounts, rather than a blanket six-month extension for all existing certificates.
See IASME’s detailed April 2026 update for the assessment changes.
What has changed in Cyber Essentials for 2026?
Cyber Essentials 2026 MFA requirements
IASME says organisations must implement MFA for cloud services where it is available, including where the vendor charges for the feature. Failure now triggers an automatic assessment failure.
For MSPs, this means checking more than Microsoft 365. Build a list of the client’s relevant cloud services and verify the actual authentication arrangements for each one.
In particular, distinguish between users registering an MFA method and policies enforcing its use. Also check alternative sign-in routes before concluding that the service has effective coverage. Ask the Certification Body about any uncertain arrangements.
Cyber Essentials patching requirements and marking changes
The 2026 marking changes make the operating-system and application security-update questions automatic-failure questions when the applicant does not meet the required standard.
The underlying NCSC requirement calls for updates within 14 days of release when they address vendor-rated critical or high-risk vulnerabilities, vulnerabilities with a CVSS v3 base score of at least 7, or vulnerabilities for which the vendor supplies no severity details. A bundled update containing a qualifying fix also falls within that requirement.
The 14-day rule is not simply a new deadline introduced in 2026. The important change here is stricter assessment marking. Nor does it mean every routine feature update has the same mandatory deadline.
Refer to NCSC’s Cyber Essentials Requirements for IT Infrastructure v3.3 for the full wording.
Cyber Essentials 2026 scope changes
The updated guidance clarifies that cloud services hosting the organisation’s data or services must remain in scope. It also explains the need to justify excluded infrastructure and describe segregation.
Consequently, agree the scope with the Certification Body before assessment. Avoid working from an old inventory that misses business applications or remote-working arrangements.
IASME’s overview of the v3.3 requirements changes explains these clarifications.
Cyber Essentials certification scope and legal entities
The assessment changes allow fuller scope descriptions and require identification of the legal entities included. Applicants must also describe excluded infrastructure, although those exclusion details do not become public.
As a practical step, ask the client to confirm which business entities the assessment covers. Do not assume a single PSA client record represents the complete certification scope.
Cyber Essentials Plus changes: compliance and retests
The revised director declaration addresses maintaining compliance throughout the certification period. For Cyber Essentials Plus, failed update-management tests require remediation and retesting of both the original sample and a new random sample. A second failure can revoke the verified self-assessment certificate. Applicants must finalise their self-assessment before Plus testing and cannot revise answers afterwards based on test results.
Therefore, remediate the wider environment rather than only the devices an assessor sampled. Treat readiness as an operational process with clear ownership.
An MSP checklist for the Cyber Essentials 2026 changes
The following checklist offers practical preparation advice. Use it alongside the official requirements and your Certification Body’s guidance; it does not replace the assessment.
1. Confirm the assessment and inventory
First, establish which requirement version applies and who will answer the assessment questions. Then check that the inventory reflects the client’s current systems and business structure.
Record the relevant devices, software and cloud services. For each entry, identify the owner and the person responsible for validating the control. This reduces the chance that everyone assumes someone else checked it.
2. Verify cloud MFA coverage
Next, review each relevant cloud service and record:
- Whether MFA is available and which subscription provides it.
- Which users and administrators require it.
- How the service enforces authentication.
- Any exceptions or alternative access routes that need investigation.
- The evidence checked and the date of that check.
If an upgrade is necessary, explain the required change and its cost to the client. However, do not describe an unsupported assumption as a confirmed failure.
3. Check patching results, not just policies
Review evidence of installation, failures and unresolved updates. Include systems outside the routine endpoint workflow, such as network-device firmware and less familiar applications.
For each exception, record the device, required fix, release date and current status. Then assign an owner and next action. If a device remains offline or an update repeatedly fails, investigate rather than treating the scheduled deployment as proof of completion.
4. Check software support dates
Also, confirm that software remains supported at the certification date. NCSC requires supported, licensed software in scope, and IASME clarifies that the assessment’s point in time is the certificate issue date.
A client might complete its questionnaire before a product reaches end of support. Therefore, compare support dates with the expected certification timeline and discuss replacement or other qualifying arrangements with the assessor.
5. Turn findings into client decisions
The Cyber Essentials 2026 changes provide a useful starting point for a client Security Review. However, clients still need to understand what you want them to approve.
For each recommendation, explain the finding, its business relevance, the proposed action and who needs to act. Keep confirmed evidence separate from questions that need further checking.
For example:
Your team uses a cloud application that offers MFA, but the current configuration does not require it. We recommend enabling the appropriate authentication policy and checking all relevant accounts before your assessment. Your Certification Body can confirm how the arrangement meets the scheme requirements.
This gives the client a clear next step without making promises about certification.
6. Follow up throughout the year
Finally, keep an action list and revisit unresolved findings. Check again when clients introduce applications, change licences or add devices.
Regular reviews can help maintain visibility between assessments. They also give clients a record of the improvements their MSP has recommended and completed.
What the Cyber Essentials 2026 changes do not mean
Cyber Essentials remains centred on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.
NCSC recommends backups, but backing up data is not a Cyber Essentials technical requirement. Therefore, discuss recovery as a valuable security measure without presenting it as a new certification control.
Likewise, a framework reference in a report does not establish compliance. The client must meet the relevant requirements within the agreed scope and complete the scheme’s assessment process.
How SecuVeo supports reviews of the Cyber Essentials 2026 changes
The Cyber Essentials 2026 changes create a timely reason to revisit clients’ security priorities. SecuVeo helps your team turn those conversations into clear findings, practical recommendations and documented follow-up.
It combines customizable templates, PSA Billing Evidence and Microsoft 365 Security Evidence to save preparation time. Your team reviews the content before delivering a branded report that clients can understand and act on.
With SecuVeo, you can:
- Explain security findings and recommended improvements in plain English.
- Include Cyber Essentials references from framework-aligned templates.
- Track report delivery and disclaimer acknowledgements.
- Create tickets and opportunities in ConnectWise PSA or HaloPSA.
- Compare reviews over time and demonstrate progress.
Together, these features give your MSP a repeatable way to communicate priorities, support assessment preparation and help clients approve the improvements they need.
Start a SecuVeo free trial to see how it fits your client review workflow.
Frequently asked questions
Is MFA required for Cyber Essentials in 2026?
IASME confirms that cloud services must use MFA where it is available, including paid options. The updated marking treats failure to implement it as an automatic assessment failure. Check the applicable requirements and any uncertain implementation with your Certification Body.
Is the 14-day patching rule new?
No. The 2026 changes strengthen assessment marking for security-update questions. NCSC’s requirements specify which vulnerability fixes fall within the 14-day installation rule.
Do the Cyber Essentials 2026 changes introduce new core controls?
No. The five control areas remain the same. The changes cover requirement clarifications, assessment marking, certification scope and parts of the Cyber Essentials Plus process.
Can a Security Review report certify a client?
No. A review helps organise findings and recommendations. Certification requires the separate Cyber Essentials assessment process; framework alignment alone does not demonstrate compliance.
Information checked on 8 October 2026. Use the official requirements and your Certification Body’s guidance when preparing an assessment.
