Cyber Essentials

overlay
5 Oct

New MOD Cyber Requirements: What Defence Suppliers Need to Know

The Ministry of Defence has asked all industry partners to work towards achieving Defence Cyber Certification (DCC) Level 0 by 31 December 2026. Defence Cyber Certification has been available for over a year, but the latest announcement sets a clear expectation that all defence suppliers should now work towards at least Level 0.

Level 0 includes a requirement to hold Cyber Essentials for all applicable business-critical systems within scope. ‘Scope’ means the parts of your business and the IT systems that the certification covers, such as computers, email accounts, networks and cloud services.

If you supply the MOD directly, the message is clear. Find out now what will be expected of your business. Waiting until the requirement appears in a tender or contract renewal could leave too little time to deal with problems.

What is Defence Cyber Certification?

Defence Cyber Certification, usually shortened to DCC, gives the MOD and its contractors a consistent way to assess the cyber security of organisations throughout the supply chain. Different levels apply depending on the work being carried out and the systems and information involved. Level 0 is the starting point.

Cyber Essentials covers five areas: firewalls, secure configuration, user access, malware protection and security updates. These are basic controls, but they prevent many of the attacks that exploit unpatched software, insecure devices and poorly managed accounts.

Although Cyber Essentials forms part of Level 0, organisations also need to meet the wider requirements of the Defence Cyber Certification (DCC) framework. Suppliers should establish which DCC level applies to their work and which parts of their organisation need to be included within its scope.

Why subcontractors need to pay attention

Defence contracts often involve a long chain of specialist suppliers. Engineering companies, manufacturers, software providers, consultants and logistics businesses may all support a larger contract without working directly for the MOD. That does not put them outside the cyber security requirement.

Prime contractors, the businesses holding the main MOD contracts, need assurance that suppliers handling their information or contributing to delivery have appropriate security controls in place. These requirements can be passed down through several levels of the supply chain.

Start by getting the scope right

One of the first jobs is to establish which systems need to be covered by certification. This is known as its scope. It may include devices, Microsoft 365 accounts, cloud services, networks and other systems used to hold information or support the contract. A Cyber Essentials certificate must cover the applicable business-critical systems. A current certificate may not be enough if it covers the wrong part of the organisation.

If you already hold Cyber Essentials, check:

  • When the certificate expires
  • Whether its scope includes all relevant systems
  • Whether your systems have changed since certification

Cyber Essentials certificates last for 12 months. Your renewal date therefore needs to fit with the December 2026 DCC deadline and any earlier date set by your customer.

Allow time to resolve problems

Cyber Essentials is achievable for most organisations, but the process can uncover work that needs to be completed first.

Unsupported software and hardware, missing operating systems and app updates, unnecessary administrator access and unmanaged devices are common findings. Microsoft 365 settings and arrangements for remote workers can also require attention.

These problems are usually manageable when found early. They become harder to deal with when a tender or contract deadline is only a few weeks away.

A readiness review checks your systems against the certification requirements. It will show you what needs attention and give you a clearer idea of the likely timescale.

How Secure360.io can help

Our Team has helped organisations achieve Cyber Essentials certification since 2017. We have supported more than 100 organisations, including clients working to fixed procurement and contract deadlines.

We review the systems within scope, identify anything that could hold up certification and explain what needs to change. Where technical work is required, we can help complete it before the formal assessment. Every organisation we have supported through certification has passed once the agreed remedial work was complete.

The formal certification decision is made by an independent certification body.

What defence suppliers should do next

If your business supplies the MOD or works for a defence prime contractor, speak to your customer and confirm:

  • Which DCC level applies to your work
  • Which systems must be covered
  • When certification evidence will be required
  • Whether the requirement extends to any of your own subcontractors

The MOD has asked industry partners to achieve Level 0 by 31 December 2026. Check whether your customer has set an earlier date for your contract.

Need help preparing for Cyber Essentials?

Secure360.io can review your current position and help you address any issues before certification.

Book a Cyber Essentials consultation

FAQs

Do all MOD industry partners need DCC Level 0?

The MOD has asked all industry partners to achieve Level 0 by 31 December 2026. Confirm the precise level and scope with your MOD contact, customer or prime contractor.

Does an existing Cyber Essentials certificate meet the requirement?

It forms part of the requirement, but you need to check that it is current and covers all applicable business-critical systems. You must also meet the other DCC requirements and obtain DCC certification.

Can the requirement be passed down to subcontractors?

Yes. The MOD has specifically told suppliers to consider subcontractor timescales where certification requirements apply further down the supply chain.

Read the Ministry of Defence announcement on Building cyber resilience in the UK one step at a time.

Shield with a lock in it
overlay
5 Nov

Cyber Essentials 2026 Update: What’s Changing

The IASME Consortium, which manages the UK Government-backed Cyber Essentials scheme, has announced that new requirements for assessments will come into effect in April 2026.

The updated version, will apply to all new Cyber Essentials assessments created after 27 April 2026. IASME says the goal is to make the standard simpler to understand and fairer to assess. Most of the wording is clearer, but some rules are tighter - especially around cloud services and multi-factor authentication (MFA).

Here’s what’s changing:

1. Cloud services must now be included

You can no longer leave out the cloud systems your business uses. IASME now defines a cloud service as any online platform that stores or processes your organisation’s data. That covers Microsoft 365, Google Workspace, Dropbox, Xero, and many other tools that many businesses use daily. If they handle your company data, they’re now part of your assessment.

2. MFA becomes mandatory

MFA has been encouraged for years, but from 2026 it becomes compulsory. If a service offers MFA and you don’t use it, your assessment will fail. This applies to all users, not just administrators. Every account with access to email, files, or systems must use MFA where possible.

3. Web applications section renamed

The part of the standard that used to cover web applications will now be called application development. It’s been rewritten to match the UK Government’s Software Security Code of Practice. Public facing apps like booking forms or customer portals are still in scope ('scope' is the boundary of what is covered by your Cyber Essentials certification). In-house systems usually aren’t, unless they’re accessible online.

4. Scoping rules made clearer

IASME has simplified how scoping works. Any device or system that connects to the internet, whether inbound or outbound, is now automatically considered in scope unless you can clearly justify excluding it. This change closes off the grey areas that sometimes led to inconsistent assessments.

5. Guidance and layout improvements

The new version is easier to follow. Key improvements include:

  • Backup guidance is now near the start, showing its importance.
  • User access control guidance has been simplified.
  • Key definitions are clearer and more consistent.

6. User Access Control and Passwordless Authentication

The User Access Control section has been expanded to include more guidance on modern login methods. The requirement itself hasn’t changed, you still need strong controls such as MFA, but the NCSC now gives greater emphasis to passwordless authentication. This includes methods such as passkeys, biometric logins, security keys, tokens, one-time codes, QR codes, and push notifications.

These options make logging in easier and more secure by removing the need for traditional passwords. IASME’s updated guidance signals that passkeys are likely to become the default recommendation in future versions of Cyber Essentials. For now, MFA remains essential, but businesses can start exploring passwordless options in platforms like Microsoft Entra ID or Google Workspace.

What this means for your business

The 2026 update won’t overhaul how Cyber Essentials works, but it does tighten the rules. The biggest changes for most SMEs will be:

  • MFA must be active everywhere it’s available.
  • Cloud services like Microsoft 365 or Google Workspace are now definitely part of your certification scope.
  • Passwordless logins will soon become best practice.

If you’ve completed Cyber Essentials before, the process will feel familiar but you’ll need to check more details carefully to pass under the new version.

Can you still do Cyber Essentials yourself?

Yes, you can complete the self-assessment on your own. However, if you want to guarantee a first-time pass, it helps to have a security partner who knows exactly what auditors look for.

At Secure360, we support SMEs across the UK by:

  • Reviewing and preparing for Cyber Essentials and CE Plus assessments
  • Checking MFA coverage across all users and systems
  • Identifying cloud services and confirming what’s in scope
  • Fixing technical or documentation gaps before submission

Get ready for 2026 now

The new Cyber Essentials version comes into effect in April 2026 but preparing early makes sense. Start by reviewing your MFA settings and cloud services now.

If you’d like expert help to get ready or want confidence in passing first time, we can help.

👉 Contact Secure360 to arrange a review and prepare for the upcoming changes.

If you would like to read the IASME article, click here.

The Cost of Cyber Threats: Why UK Businesses Must Invest in Cybersecurity
overlay
1 Sep

The Cost of Cyber Threats: Why UK Businesses Must Invest in Cybersecurity

The ROI of Cybersecurity: Why Prevention Pays Off

In April 2025, a wave of high-profile cyber attacks in the UK disrupted operations at Marks & Spencer (M&S), the Co-op, and Harrods. These incidents serve as timely reminders that cybersecurity is not just a technical issue, it’s a board-level concern with real commercial consequences. The financial and reputational damage suffered by these businesses illustrates the growing cost of cyber threats and the need for proactive investment in digital defences.

The Financial Impact of Cyber Attacks

When M&S was hit by a cyberattack, it wasn’t just an IT headache. The retailer was forced to suspend online orders and click-and-collect services, directly affecting revenue and customer experience. According to the Financial Timewww.ft.com, M&S’s market value dropped by £700 million in the aftermath, demonstrating how investor confidence can plummet when a business is seen as vulnerable to digital threats.

The Co-op also fell victim to a serious breach, with hackers gaining access to customer data including names and contact details. The data breach affected both current and former members, raising questions about data retention practices and the security of legacy systems. Meanwhile, Harrods reported attempted intrusions that prompted the retailer to limit internet access across its sites - a drastic move that likely affected internal operations and staff productivity.

These examples highlight that the financial damage from UK cyber attacks is often immediate and visible. But the longer-term effects are just as concerning and harder to quantify.

Beyond the Immediate Costs

The cost of cyber threats extends far beyond the initial disruption. A breach often triggers a chain reaction of problems. Reputational damage can lead to customer attrition, as trust in the organisation’s ability to safeguard data is eroded. Even loyal clients may start looking elsewhere.

Operational disruption lingers, too. Systems must be restored, security reviewed, and new measures put in place - all of which diverts time, money and internal resources. Staff may find themselves dealing with a spike in customer complaints, system errors, or manual workarounds, which affects morale and performance.

Then there’s the legal and regulatory dimension. Failure to protect personal data can result in investigations, fines, and enforcement action from the Information Commissioner’s Office. For businesses operating in regulated sectors, this can be particularly damaging.

In short, once an attack hits, costs multiply quickly from lost revenue and emergency IT support to legal fees and crisis communications.

Cybersecurity as a Business Strategy

There’s a misconception that cybersecurity spend is dead money, something that reduces profit rather than adds value. In reality, effective cybersecurity is a form of insurance, investment, and risk management all rolled into one. It protects revenue, preserves reputation, and maintains business continuity.

By identifying vulnerabilities and implementing controls before attackers strike, businesses can significantly reduce their exposure to risk. This approach also brings cost savings: responding to an attack is almost always more expensive than preventing one.

In competitive sectors, robust cybersecurity practices can offer an edge. Clients, partners, and investors are more likely to engage with companies that take security seriously. In some industries, it’s a prerequisite for contracts and partnerships. And with regulation tightening across the UK and Europe, compliance is no longer optional – it is essential.

Cybersecurity investment is no longer a luxury

The threat of cyber attacks in the UK is growing, but so too are the tools and expertise available to combat it. Investing in cybersecurity isn’t a luxury—it’s a basic requirement for business resilience. The real cost of inaction is paid not only in fines and lost revenue, but in brand damage, customer churn, and missed opportunities.

For any business that wants to grow confidently in an increasingly digital economy, cybersecurity must be part of the plan from day one.

Find out more about cyber security services

Secret Link