Hot Topic – Changes to Cyber Essentials

Cyber Essentials is updating and if you are planning to certify or renew in 2026 or early 2027 there are some important changes you need to be aware of. 

From 27th April 2026 a set of updates approved by the National Cyber Security Centre and the Government’s Department for Science, Innovation and Technology (DIST) came into effect. These changes are based on real breach investigations and audit insights and are designed to strengthen the consistency, clarity and credibility of the Cyber Essentials program.

What has not changed?

Cyber Essentials continues to focus on defending against common cyber attacks by concentrating on five core technical controls:

1. Firewalls and Internet Gateways
2. Secure Configuration
3. User Access Control
4. Malware Protection
5. Security Update Management

 What has changed since April 2026?

Whilst the controls remain the same, how they are assessed and verified has become more explicit:

• A new self-assessment question set
  • The questions are designed to remove ambiguity and clarify expectations around MFA, patch management and scope.
• Stricter marking and new auto-fail requirements
  • Some requirements will now trigger automatic failure if they are not met e.g. MFA, security updates and patching.
• Greater transparency around scope
  • Descriptions of what’s in scope and an explanation of what’s excluded with some services which are now unable to be excluded. 

 What does this mean for me?

Cyber Essentials is not being made harder for the sake of it. It is becoming clearer, more consistent and more aligned with how modern cyber attacks actually happen. The importance of having Cyber Essentials certification is growing and even small businesses need to consider going through the process, especially if they hold special category data.  The cost is relative to the size of your business and the standards being tested are straightforward and what you should consider as standard anyway!