The IASME Consortium, which manages the UK Government-backed Cyber Essentials scheme, has announced that new requirements for assessments will come into effect in April 2026.
The updated version, will apply to all new Cyber Essentials assessments created after 27 April 2026. IASME says the goal is to make the standard simpler to understand and fairer to assess. Most of the wording is clearer, but some rules are tighter – especially around cloud services and multi-factor authentication (MFA).
Here’s what’s changing:
1. Cloud services must now be included
You can no longer leave out the cloud systems your business uses. IASME now defines a cloud service as any online platform that stores or processes your organisation’s data. That covers Microsoft 365, Google Workspace, Dropbox, Xero, and many other tools that many businesses use daily. If they handle your company data, they’re now part of your assessment.
2. MFA becomes mandatory
MFA has been encouraged for years, but from 2026 it becomes compulsory. If a service offers MFA and you don’t use it, your assessment will fail. This applies to all users, not just administrators. Every account with access to email, files, or systems must use MFA where possible.
3. Web applications section renamed
The part of the standard that used to cover web applications will now be called application development. It’s been rewritten to match the UK Government’s Software Security Code of Practice. Public facing apps like booking forms or customer portals are still in scope (‘scope’ is the boundary of what is covered by your Cyber Essentials certification). In-house systems usually aren’t, unless they’re accessible online.
4. Scoping rules made clearer
IASME has simplified how scoping works. Any device or system that connects to the internet, whether inbound or outbound, is now automatically considered in scope unless you can clearly justify excluding it. This change closes off the grey areas that sometimes led to inconsistent assessments.
5. Guidance and layout improvements
The new version is easier to follow. Key improvements include:
- Backup guidance is now near the start, showing its importance.
- User access control guidance has been simplified.
- Key definitions are clearer and more consistent.
6. User Access Control and Passwordless Authentication
The User Access Control section has been expanded to include more guidance on modern login methods. The requirement itself hasn’t changed, you still need strong controls such as MFA, but the NCSC now gives greater emphasis to passwordless authentication. This includes methods such as passkeys, biometric logins, security keys, tokens, one-time codes, QR codes, and push notifications.
These options make logging in easier and more secure by removing the need for traditional passwords. IASME’s updated guidance signals that passkeys are likely to become the default recommendation in future versions of Cyber Essentials. For now, MFA remains essential, but businesses can start exploring passwordless options in platforms like Microsoft Entra ID or Google Workspace.
What this means for your business
The 2026 update won’t overhaul how Cyber Essentials works, but it does tighten the rules. The biggest changes for most SMEs will be:
- MFA must be active everywhere it’s available.
- Cloud services like Microsoft 365 or Google Workspace are now definitely part of your certification scope.
- Passwordless logins will soon become best practice.
If you’ve completed Cyber Essentials before, the process will feel familiar but you’ll need to check more details carefully to pass under the new version.
Can you still do Cyber Essentials yourself?
Yes, you can complete the self-assessment on your own. However, if you want to guarantee a first-time pass, it helps to have a security partner who knows exactly what auditors look for.
At Secure360, we support SMEs across the UK by:
- Reviewing and preparing for Cyber Essentials and CE Plus assessments
- Checking MFA coverage across all users and systems
- Identifying cloud services and confirming what’s in scope
- Fixing technical or documentation gaps before submission
Get ready for 2026 now
The new Cyber Essentials version comes into effect in April 2026 but preparing early makes sense. Start by reviewing your MFA settings and cloud services now.
If you’d like expert help to get ready or want confidence in passing first time, we can help.
👉 Contact Secure360 to arrange a review and prepare for the upcoming changes.
If you would like to read the IASME article, click here.