With cyber attacks continuing to rise, the UK’s Cyber Essentials scheme is a vital line of defence for businesses of all sizes. A new version of the standard takes effect for assessments booked from 27 April 2026, bringing clarifications and a few important changes. This post explains what’s new, why it matters, and how to get your organisation ready.
Why the 2026 update matters
Cyber Essentials remains a simple, affordable way to demonstrate good cyber hygiene. The update:
- clarifies the rules around multi‑factor authentication (MFA): if a cloud service offers MFA, you must turn it on or fail the assessment.
- tightens patch management by requiring high‑risk or critical updates to be applied within 14 days.
- requires more detailed scoping information, including identification of all legal entities in scope.
- confirms that compliance is assessed at a “point in time” but must be maintained throughout the certification year.
- introduces new rules for Cyber Essentials Plus, such as mandatory retesting and no post‑audit changes to self‑assessment answers.
Overall, the scheme still focuses on five core controls: firewalls, secure configuration, access control, malware protection and patch management.
Key changes summarised
- Mandatory MFA – Every cloud service that offers MFA must have it enabled, even if it costs extra. Opting out is no longer accepted.
- Patch deadlines – High‑risk and critical patches must be installed within 14 days on operating systems, network devices and applications.
- Detailed scope – Organisations must clearly describe what’s in scope and justify any exclusions.
- Point‑in‑time definition – The new guidance clarifies that certification represents a snapshot in time and stresses ongoing compliance.
- Cyber Essentials Plus retesting – Technical tests will be repeated to ensure consistency, and self‑assessment answers cannot be edited after the audit.
- Updated guidance – Improved definitions of cloud services, simplified wording for legacy tech, more emphasis on backups and password‑free technologies.
Your 2026 readiness checklist
- Plan your assessment date – Book your Cyber Essentials assessment in good time, considering the new rules apply only to assessments created from 27 April 2026.
- Enable MFA everywhere – Check every cloud service used by your organisation. If MFA is available, turn it on.
- Review patch management – Ensure there’s a process to apply critical updates within 14 days across all systems and devices.
- Define your scope – Identify all networks, devices, applications and legal entities that will be covered by the certification. Document any exclusions with justification.
- Review backup and recovery – Ensure you have reliable, tested backups and consider using separate offline or cloud backups to meet the updated guidance.
- Prepare for Cyber Essentials Plus – If you’re going for the Plus badge, be ready for retesting and have your documentation locked down before the technical audit begins.
- Train your staff – Communicate the changes to IT teams and end‑users, emphasising MFA use, patch discipline and incident reporting.
The role of AI in cyber security
Artificial intelligence is both a threat and a tool. While AI can automate attacks (for example, more convincing phishing emails or credential stuffing), it also helps defenders with anomaly detection, threat hunting and incident response. As you prepare for Cyber Essentials 2026:
- Be aware of AI‑enabled phishing – Train staff to recognise deepfakes and AI‑generated scams.
- Use AI responsibly – Leverage AI‑powered tools to monitor networks and detect unusual behaviour, but understand their limitations and avoid blindly trusting automation.
- Protect training data – If you develop or use AI models, ensure that sensitive data used in training is properly anonymised and secured.
Conclusion
The 2026 Cyber Essentials update doesn’t rewrite the scheme; it clarifies expectations and tightens some controls. By planning ahead, enabling MFA, and keeping patching and scope documentation in order, your organisation can stay compliant and more secure. Remember that certification is just the start—maintaining good cyber hygiene throughout the year is what truly protects your business.