Cyber Essentials changed in April 2026. MFA is now pass or fail.

If you hold Cyber Essentials, or a customer has asked you to get it, the scheme changed on 27 April 2026 and the change has teeth.

Version 3.3 brought a new question set — Danzell, replacing Willow — and with it a hardening of how multi-factor authentication is assessed. MFA on cloud services moved from expected to mandatory. Where a cloud service offers MFA and you have not enabled it, that is now an automatic fail. No warning, no partial credit, no remediation window.

The bit that catches people

The auto-fail applies regardless of how MFA is provided. It does not matter whether it is free, bundled, delivered through another identity service, or only available on a paid tier of the product. If the service offers it and you have not turned it on, you fail.

That last clause is the one to read twice. “It is only on the more expensive plan” used to be a defensible answer. It is not one any more.

Two other changes matter alongside it. There is now a formal definition of what counts as a cloud service, and cloud services can no longer be excluded from scope. Between them, these close the gap that let organisations quietly scope out the systems they had not got round to securing.

One timing detail worth knowing

The version that applies to you is set by when you create your assessment account, not when you submit it. An account created before 27 April 2026 completes under the old v3.2 Willow question set even if you finish afterwards; anything created on or after that date is v3.3.

If you are renewing, assume v3.3 and prepare for it.

What to do this week

The work is not large. It is just tedious, and it is the tedium that makes people defer it.

1. List every cloud service the business uses. Not the ones IT knows about — all of them. Email, file storage, accounting, CRM, your website's admin, your domain registrar, your payment provider, the design tool one person expensed. The shadow list is always longer than the official one.
2. For each, check whether MFA is available and enabled. Available and off is the failure condition.
3. Start with the accounts that can cause the most damage. Your domain registrar and your email are worth more to an attacker than almost anything else you own, because both can be used to take over everything else.
4. Prefer an app or a hardware key to SMS. SMS is better than nothing and worse than the alternatives.
5. Write down who has access to what. Half the value of this exercise is discovering the accounts belonging to people who left.

Is certification worth it if nobody has asked?

Sometimes. The controls are worth implementing regardless — they are the ordinary measures that stop the attacks that actually happen to small businesses, which we went through in the three attacks that actually hit small businesses.

The certificate itself is worth having when you sell to the public sector or to larger companies that ask for it in procurement, when your insurer offers a meaningful discount for it, or when you want the included cyber liability cover — UK organisations under £20m turnover certifying their whole organisation get £25,000 of cover and access to an incident response line.

If none of those apply to you, do the controls and skip the badge. We would rather tell you that than sell you a certification you do not need.

The wider direction

Insurers are moving the same way as the scheme. Cyber cover increasingly comes with control requirements attached rather than being a simple purchase, and MFA is consistently top of the list. Whether or not you certify, the market is converging on the same expectation, and it is a reasonable one.

We work on this at whichever layer the risk sits — access control, patching, segmentation, and backups that have actually been restored. If you would like someone to go through your cloud accounts with you before a renewal, book a free call.