Renewing your Cyber Essentials certificate soon? The rules changed in April 2026, and two of the changes are automatic fails. If you passed last year, you could still fail this time.
New to the scheme? Start with our guide to what small businesses need to prepare for Cyber Essentials.
📅 What changed
- New rules (v3.3) took effect on 27 April 2026
- The question set is now called Danzell (it replaces Willow)
- Account opened before 27 April: you can use the old rules, with 6 months to finish
- Account opened after 27 April: you’re assessed under v3.3
🔐 Change 1: MFA on every cloud service
If a cloud service offers MFA, you must switch it on. This applies even if MFA is a paid extra. Miss one and you fail.
It covers more than Microsoft 365. Check your:
- 💼 Accounting and payroll software
- 📇 CRM and practice management systems (see the hidden risks in cloud CRMs)
- 🏥 Care planning, rostering or patient record systems
- 🏦 Online banking and payment platforms
- 📁 File sharing and e-signature tools
- 🌐 Domain and website hosting accounts
Quick check:
- List every cloud service your team uses
- Mark which ones offer MFA
- Make sure it’s on for every user, including admins and shared accounts
- Save the list, because you’ll need it for the assessment and next year
MFA works best alongside strong passwords. Test yours with our Password Strength Checker.
⏱️ Change 2: Critical updates within 14 days
High-risk and critical security updates must go on within 14 days of release. An update counts if the vendor rates it high or critical, or if it fixes a flaw scoring 7 or above on the CVSS v3 scale.
The 14-day rule applies to:
- 💻 Operating systems on laptops, desktops, servers and phones
- 🧩 Apps such as browsers, PDF readers and video calling tools
- 🔥 Firewalls
- 📡 Routers
Where businesses get caught out:
- 📡 Routers and firewalls that haven’t been updated in years (5 office network mistakes that put businesses at risk)
- 🧩 Apps that Windows Update doesn’t patch
- 📋 No record of when updates were installed, so there’s no proof
- ⛔ Old devices or software that no longer get updates, which must be replaced or removed
This is where proactive IT maintenance pays off.
📌 Other changes to know
- 💾 Backups get more weight, with a focus on being able to recover your data (the real cost of downtime)
- 🔑 Passwordless sign-in, such as passkeys and FIDO2 keys, is encouraged
- 🔍 On Cyber Essentials Plus, fixes are checked on a new random sample of devices
- 📜 ISO 27001 doesn’t exempt you
✅ Before you renew
- List every cloud service and its MFA status
- Confirm critical updates reach every device within 14 days, and that you can prove it
- Check router and firewall firmware, and agree who updates them
- Find any device or app that no longer gets updates
- Test that a backup actually restores
- Open your assessment account once all of the above is done
🤝 How Guard IQ can help
We help healthcare providers and law firms get ready for Cyber Essentials and stay compliant all year:
- 🔐 MFA set up and enforced across your systems
- 🔄 Patching managed, with a record of every update
- 📂 Evidence ready well before your assessment date
Healthcare providers can also read our DSPT guide for London clinics. Law firms preparing for Lexcel should see the IT gaps assessors look for.
👉 Try our free Cyber Essentials Readiness Checker
📞 Or call 020 8537 8167 to book a free consultation