020 3802 6525

[email protected]
astec logo
Contact Us
Book Your IT Review
Book Your IT Review

Cyber Essentials Requirements 2026

A guide for London and UK businesses with 10 to 100 staff: what changed in the Danzell question set, the two questions that now fail you outright, and the six-week plan to fix them.

Most businesses do not fail Cyber Essentials on something exotic. They fail on patching and passwords.

The Cyber Essentials requirements for 2026 make that failure automatic. Two questions about security updates now end the assessment on their own, however well you score everywhere else. And on 26 October 2026, the grace period that let earlier applicants keep using the old rules runs out.

This guide is for London and UK businesses with 10 to 100 staff. What changed, what to check, and what your IT support company should already have in hand.

IT Review

Book Your Cyber Security Review

No obligation. Speak with a dedicated IT specialist within 2 business days.

Book Your IT Review
020 3802 6525

What changed in the Cyber Essentials requirements for 2026?

The five technical controls are unchanged. What changed is the marking. Multi-factor authentication on cloud services and two new questions on 14-day security updates are now automatic failures. Scope rules tightened, cloud services can no longer be excluded, and a Cyber Essentials Plus retest now adds a second random sample of devices.

Cyber Essentials is set by the National Cyber Security Centre and delivered by IASME. It is reviewed every year against scheme feedback, breach investigations and IASME’s own assessor audits. The 2026 review produced the Danzell question set, announced on 12 February 2026 and published the following day, alongside version 3.3 of the Requirements for IT Infrastructure.

The scheme applies to organisations of every size, and it is increasingly not optional. Clients ask for it in procurement. Insurers ask for it at renewal. Many government contracts require it outright. What has changed is that the bar for passing is now less forgiving — and the two questions it turns on are the two that UK businesses are weakest at.

When does the old Cyber Essentials question set expire?

26 October 2026. Organisations with an active assessment account created before 26 April 2026 were given six months to certify under the previous requirements. After that date, every assessment runs on the Danzell question set and version 3.3 requirements, regardless of when the account was opened.
If you bought an assessment earlier in 2026 and have not submitted it, the clock is the thing to check first. IASME gives you six months from purchase to complete an assessment, so a good number of businesses are sitting on a part-finished submission written against rules that expire in a few weeks.

If you certify after 26 October, or you open a new account now, you are on the new rules either way.

WHAT'S IN THIS GUIDE

  1. What changed in the Cyber Essentials requirements for 2026
  2. When the old question set expires
  3. The two new auto-fail questions
  4. Why UK SMEs fail on exactly these controls
  5. Everything else that changed in the Danzell question set
  6. What a good IT support company should already be doing
  7. Your six-week plan before 26 October
  8. What Cyber Essentials costs in 2026
  9. IT support for London and UK SMEs
  10. Frequently asked questions
Share This Article

What are the two new Cyber Essentials auto-fail questions?

A6.4 and A6.5. A6.4 asks whether all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware are installed within 14 days of release. A6.5 asks the same for applications, including associated files and extensions. Answer no to either and the assessment fails outright.
An auto-fail question is exactly what it sounds like. It is not weighted, and it cannot be offset by strong answers elsewhere. Get it wrong and the assessment ends there.

A6.4 — operating systems, routers and firewalls

This is the one that catches the hardware nobody owns. Windows and macOS updates are usually managed. Router and firewall firmware often is not, especially when the router arrived with the ISP contract and has never been touched since.

Ask a simple question: what firmware version is the office firewall running, and when was it last updated? If nobody can answer within the hour, that is the finding.

A6.5 — applications, files and extensions

Applications are harder than operating systems because there are more of them and they update on their own schedules. This question covers browsers and their extensions, PDF readers, design tools, line-of-business software, and anything else installed on a device in scope.

Fourteen days is not a long window for a business without automated patching, vulnerability scanning and proactive monitoring across every device. It is comfortable for a business that has it.

The auto-fail that came first: MFA on every cloud service

Multi-factor authentication became an automatic failure ahead of the two update questions, announced in November 2025. The rule is absolute: MFA must be enabled on every cloud service that offers it, whether the feature is free, bundled or paid for. Deciding a paid MFA add-on is not worth the money is now a failed assessment.

Version 3.3 also added a formal definition of a cloud service, and made clear that cloud services cannot be excluded from scope. If your data or services sit there, they are in. That closes the most common scoping shortcut, and it makes an accurate inventory of your Microsoft 365 and other cloud accounts the first thing to build.

There is a much better way to do this than service by service. Where a cloud service supports single sign-on (SSO), turn it on from the outset and point it at your identity provider (IdP) — Microsoft Entra ID for most businesses on Microsoft 365. You then enforce MFA once, as a policy on the IdP, and every connected service inherits it.

The difference matters at assessment time. Managing MFA separately on twenty services means twenty configurations to check, twenty places for a new starter to be missed, and twenty screenshots to produce as evidence. Enforcing it at the IdP means one policy, one report, and one place to prove it. It is also the only approach that scales as you add services.

Why UK SMEs fail on exactly these controls

Because these are the two weakest controls in UK business, by the government’s own measurement. The Cyber Security Breaches Survey 2025/2026 found that only 34% of UK businesses have a policy to apply software security updates within 14 days, and only 47% have any requirement for two-factor authentication at all.
Read those two numbers next to the new marking criteria and the picture is blunt. Roughly two-thirds of UK businesses do not have a patching policy that would satisfy A6.4 and A6.5. Slightly more than half have no two-factor authentication requirement of any kind.

The same survey found 43% of UK businesses identified a breach or attack in the previous 12 months, and that 5% hold Cyber Essentials. It also found that 18% of businesses did not know whether they adhered to Cyber Essentials, Cyber Essentials Plus or ISO 27001 — despite the survey being answered by the person each organisation named as most responsible for cyber security.

Not knowing is a service problem rather than a technology problem. The person who runs your IT should be telling you where you stand without being asked.

Everything else that changed in the Danzell question set

What changedWhat it means for you
Cloud services defined, and cannot be excludedEvery cloud service holding or processing your data is in scope. No exceptions.
Unlimited scope descriptionsYou can now describe scope in full on the digital certificate rather than in one line.
Out-of-scope areas must be describedYou must state what is excluded and how it is segregated. Not published, but assessed.
Legal entities namedEach entity in scope needs a name, address and company number. Individual certificates available for a fee.
“Point in time” clarifiedIt means the date the certificate is issued. Systems must be supported on that date.
Board declaration extendedA director now signs to say the controls will be maintained across the whole certification period, not just on assessment day.
CE Plus retests add a second random sampleA retest rechecks the original devices and a new random sample, so fixing only what failed no longer works. A second failure revokes the self-assessment certificate too.
Self-assessment locked before CE PlusYou can no longer amend your answers after seeing the CE Plus results.
Passkeys and passwordless highlightedAccess control guidance now points at passkeys as the stronger option.
The board declaration change is quietly the biggest of these. Cyber Essentials has always been a snapshot. A director now signs a statement that the controls stay in place for the full 12 months — which turns an annual form-filling exercise into an ongoing operational commitment, and puts the weight of it on whoever runs your IT.

What a good IT support company should already be doing

Here is the test. Put these six questions to your IT support company and compare the answers to the right-hand column.
Ask themA weak answerWhat good sounds like
How fast do we apply critical updates?“We patch monthly.”“Within 14 days — here is last month’s report.”
Which cloud services do we use, and which support SSO?“Microsoft 365, I think.”A current inventory of every cloud service, flagging which sit behind single sign-on and the MFA status of each.
Is MFA enforced by policy on our identity provider?“It’s on for email.”One enforced IdP policy covering every SSO-connected service, with direct MFA on anything that cannot do SSO.
What firmware is the firewall on?“It came with the internet line.”Model, firmware version, date last updated, and who owns it.
What’s in scope, and what isn’t?“The office.”A written scope with legal entities, exclusions and how they’re segregated.
Can you evidence all of that?“I’ll look into it.”The report, this week.
None of these are unreasonable requests. They are the operational records any managed IT support arrangement should already produce as a by-product of doing the work. If they take a fortnight to assemble, they were not being produced.

We answer these questions because we are asked them. Astec IT is a London-based managed IT support company supporting 10–100 staff SMEs across London and the UK, 24/7, and certification support — Cyber Essentials and ISO standards — is part of the job. We put the controls in place and produce the evidence. We do not sign off the certificate, and no IT company can.

Your six-week plan before 26 October

1. Check your assessment account date. Created before 26 April 2026 and not yet certified? You are on the old rules until 26 October and then you are not. Decide now whether you are racing the deadline or planning for the new question set.

2. List every cloud service with an account. Not just the obvious ones. File sharing, CRM, accounting, design tools, e-signature, HR, the marketing platform someone signed up for in 2023.

3. Check each service for SSO first, then turn MFA on wherever it is offered. If a service supports single sign-on, connect it to your identity provider and enforce MFA there once rather than configuring it service by service. For anything that cannot do SSO, enable MFA on the service directly — free, bundled or paid. Where a service genuinely offers no MFA at all, write down that it does not.

4. Fix operating system and firmware patching. Get every device on automatic updates, and put the router and firewall firmware on a named owner with a review date.

5. Get applications and extensions under control. Browsers, plugins, PDF tools, line-of-business software. Remove what nobody uses — it is the cheapest way to shrink the problem.

6. Retire anything you cannot patch. Unsupported software on the certification date is a fail.This is the same trap as Windows 10 end of support, and the same answer: replace it or take it out of scope properly.

7. Write the scope down. Legal entities, addresses, company numbers, what is excluded and how it is separated from everything else.

8. Run a dry pass. IASME publishes the self-assessment questions free. Answer them honestly before you pay for anything.

Steps 3 to 6 are where most of the work sits, and they are also the steps a competent IT support company in London should be doing for you already — with or without a certification deadline.

What Cyber Essentials costs in 2026

IASME’s assessment fees are banded by organisation size. As at September 2026, the published prices are £320 + VAT for micro organisations (0–9 staff), £440 + VAT for small (10–49), £500 + VAT for medium (50–249) and £600 + VAT for large (250+). Cyber Essentials Plus is quoted separately.
The certificate is the small number. The real cost is the remediation work behind it — MFA licensing, patch management tooling, replacing whatever cannot be updated. If those are already in place because your IT is run properly, certification is a form-filling exercise. If they are not, the certificate fee is the least of it.

Certification lasts 12 months and assessors review submissions within three working days.

IT support for London and UK SMEs

Astec IT is headquartered in London and supports businesses across Greater London, the Home Counties and the wider UK — Hertfordshire, Kent, Surrey, Leicester, Liverpool and Manchester. We work with businesses of 10 to 100 staff, most of them switching from an incumbent rather than buying IT support for the first time.

Do you need a London IT support company, or will remote do?

For everything in this guide, remote is fine and usually faster. Patching, MFA rollout, monitoring and certification evidence are all delivered without anyone leaving their desk. On-site presence earns its keep elsewhere: hardware installs, office moves, and having a face in the room when something serious breaks. Ask any supplier how quickly someone can physically attend, and treat a vague answer as the answer.

Why London and UK SMEs switch

Rarely because of one disaster. Usually because a deadline like this one arrives as a surprise, and it becomes clear that nobody has been looking ahead on their behalf. That is the moment the monthly fee starts to look like a subscription to a phone number. Our client results mostly begin there, the signs it’s time to change IT support company set out the rest, and the resource library covers the other deadlines worth diarising.

Areas we cover

London (HQ) · Greater London · Hertfordshire · Kent · Surrey · Leicester · Liverpool · Manchester

Frequently asked questions

What are the Cyber Essentials requirements for 2026?
The five technical controls are unchanged: firewalls, secure configuration, security update management, user access control and malware protection. What changed is how strictly they are marked. MFA on cloud services and two security update questions are now automatic failures, and scope rules have tightened significantly.
When does the old Cyber Essentials question set expire?
26 October 2026. Organisations with an assessment account created before 26 April 2026 had six months to certify under the previous requirements. After that date all assessments use the Danzell question set and version 3.3 of the Requirements for IT Infrastructure.
Does Cyber Essentials require MFA on every cloud service?
Yes, wherever the service offers it — free, included or paid. There is no cost exemption, and missing MFA on an available service is an automatic failure. Where a service supports single sign-on, connect it to your identity provider and enforce MFA there once, rather than configuring twenty services separately. Cloud services cannot be excluded from scope.
What is the Cyber Essentials 14-day patching rule?
All high-risk or critical security updates and vulnerability fixes must be installed within 14 days of release. Question A6.4 covers operating systems and router and firewall firmware. A6.5 covers applications, including any associated files and extensions. Both are automatic failures, so a single unpatched browser extension can end the assessment.
Why do businesses fail Cyber Essentials?
Usually on patching and authentication rather than anything sophisticated. Government figures show only 34% of UK businesses have a 14-day update policy and 47% require two-factor authentication. Unsupported software, unmanaged firewall firmware and unpatched browser extensions account for most failures.
How much does Cyber Essentials cost in 2026?
IASME’s published assessment fees run from £320 + VAT for organisations with 0–9 staff to £600 + VAT for 250+, with 10–49 staff at £440 + VAT. Cyber Essentials Plus is priced by quote. Remediation work usually costs more than the certificate itself.
Do you provide IT support for London businesses?

Yes. Astec IT is headquartered in London and supports SMEs of 10 to 100 staff across Greater London and the UK, 24/7, with no call-centre queue. We also cover Hertfordshire, Kent, Surrey, Leicester, Liverpool and Manchester. Certification support is included in our cyber security services.

Does my IT support company need to be local to my office?

Not for most tasks. Patching, MFA rollout, monitoring, backups and certification evidence are all delivered remotely, and remote is usually faster. Being local matters for on-site work — hardware installs, office moves, and incidents that need a person in the room. Ask any prospective supplier how fast someone can physically attend.

What is the best IT support option for a London SME?

For a business of 10 to 100 staff, a fixed monthly managed service with named dedicated engineers usually beats both ad-hoc support and a first internal hire. You get patching, monitoring and certification evidence as standard rather than as chargeable extras.

Can an IT support company certify us for Cyber Essentials?
Only a licensed Certification Body can issue the certificate. An IT support company can put the controls in place, produce the evidence and prepare your answers — which is most of the work. Be wary of anyone claiming to guarantee a pass; nobody can.

What to do next

Send your IT support company one message: “Can you send me a report showing that all high-risk and critical updates were applied within 14 days last month, and a list of every cloud service we use with its MFA status?”

If that lands in your inbox quickly and it is complete, you are in good hands and 26 October is a non-event. If it takes a fortnight, or it never comes, you have learned something more useful than any sales pitch.

We track and share ours. Book a call and we will show you exactly what that reporting looks like.

Sources:

IASME, Important Update: Changes to Cyber Essentials for April 2026 (12 February 2026) · IASME, Cyber Essentials scheme and published pricing (accessed September 2026) · NCSC, Cyber Essentials Requirements for IT Infrastructure v3.3 · DSIT and Home Office, Cyber Security Breaches Survey 2025/2026 (30 April 2026)