Cyber Essentials Requirements in 2026: What Changed, and What Now Fails You Automatically
Cyber Essentials requirements changed in April 2026, and the change that matters most is not a new control. It is a new way of failing.
The scheme moved to a revised question set which attaches automatic failure to two specific areas: multi-factor authentication on cloud services, and applying critical security updates within 14 days.
An automatic fail is not a mark you can make up elsewhere in the assessment. Get either of those wrong and the answer is no, regardless of how well the rest of your environment is configured.
For organisations certifying for the first time this makes preparation more predictable, because you know exactly which two things will sink you. For organisations renewing, it is worth checking before you start rather than during, because both take longer to fix properly than the assessment itself takes to complete.
Nothing here is unreasonable. Both requirements describe things a well-run environment should already be doing. The difficulty is that plenty of environments are not doing them, and until this year that was survivable.
Quick summary
The five controls are unchanged. What changed is how strictly two of them are now judged.
Anything registered before the changeover continues under the previous question set, so nobody partway through gets caught out.
What actually changed
Cyber Essentials is reviewed each year by the National Cyber Security Centre and IASME. The April 2026 update moved the scheme to Requirements for IT Infrastructure version 3.3, with a question set named Danzell replacing the previous Willow set.
The five control areas stayed as they were: firewalls, secure configuration, user access control, malware protection and security update management. No new control was added, and none was removed.
What tightened was the standard of evidence within them, and the consequence of falling short. Where previously a weak answer contributed to an overall picture, two specific answers now end the assessment on their own.
The MFA automatic fail
Multi-factor authentication on cloud services has been expected for some time. It is now non-negotiable.
The practical trap is not organisations without MFA. Those already know where they stand. It is organisations that have MFA and assume that settles it. The gaps that catch people are the familiar ones:
- MFA enforced for administrators but not for standard accounts
- MFA required only from unfamiliar locations, leaving trusted networks exempt
- Policies correctly configured and then left in report-only mode, monitoring rather than enforcing
- Legacy authentication protocols still enabled, which bypass the prompt entirely
That last pair is worth dwelling on, because it is exactly how attackers got into 78 accounts across 64 organisations in the Microsoft 365 password spray campaign earlier this year. In most of those organisations MFA existed. It simply was not enforced everywhere it needed to be. An assessor asking whether MFA is enforced on cloud services is asking the same question the attacker did.
The 14-day patching automatic fail
Critical and high-severity updates must be applied within 14 days of release. This one is less about capability than about consistency, and consistency is harder than it sounds across a real estate of devices.
Two things commonly go wrong.
The first is coverage. Automated update management handles the devices enrolled in it. Any laptop that never got enrolled, or quietly dropped out of management, is still in scope for the assessment while being outside your patching process. Windows Autopatch is a strong answer for Microsoft’s own updates, and it only reaches devices that meet its prerequisites.
The second is third-party software. Browsers, PDF readers, conferencing tools and the rest all fall within the 14-day requirement, and no Microsoft tool patches them for you. Organisations that automate Windows updates and stop there frequently believe this control is handled when roughly half of it is not.
Both need a demonstrable answer, not a reasonable-sounding one. The question an assessor asks is how you know, and the answer needs to be a report rather than an assurance.
Passwordless, scoping and the rest
Three smaller changes are worth knowing about.
Passwordless authentication is explicitly encouraged. Passkeys are named in the updated guidance under user access control. This is not yet a requirement, and it does signal the direction the scheme is travelling, which matters if you are planning authentication changes anyway.
Scoping guidance was clarified. Scope is the most common cause of assessment difficulty, usually because an organisation defines it narrowly hoping to exclude awkward devices, and an assessor disagrees. Anything accessing organisational data counts, including personal devices and contractor machines.
Cloud services and backup expectations were tightened. Both areas received clearer guidance, which reduces the room for interpretation that previously existed.
What to check before you start
If you are certifying or renewing this year, four checks will tell you whether you have a problem, and all four can be done in an afternoon.
- Is MFA enforced, not just configured? Check whether any Conditional Access policy sits in report-only mode, and whether any account or application is exempt.
- Is legacy authentication blocked? If it is still available, MFA can be bypassed regardless of policy.
- Can you evidence patching within 14 days? Not whether it happens, but whether you can produce a report showing it.
- Is every in-scope device actually managed? Including personal and contractor devices that access organisational data.
If all four are clean, the rest of the assessment is unlikely to surprise you. If any are not, fix them before registering rather than after.
Would your tenant survive the two automatic fails?
Our free Microsoft 365 risk and cost health check tests your MFA enforcement and patching evidence against what Cyber Essentials now requires, and tells you what would need fixing before you register. No obligation, and if you are already in good shape we will say so.
The bottom line on the 2026 Cyber Essentials requirements
The changes made the scheme stricter without making it harder to understand. Two things now decide the outcome before anything else is considered, and both describe practices that stop the attacks organisations actually experience rather than hypothetical ones.
That is arguably the more useful way to read the update. Enforced MFA and prompt patching are not certification hoops. They are the two controls that would have prevented most of the incidents reported in the past year, and the scheme has simply stopped pretending otherwise.
If you are working out where you stand, our Cyber Essentials certification and support page sets out what readiness involves and who does what, and our Microsoft 365 Support service keeps the controls in place between annual renewals, which is where most organisations lose ground.
STRAIGHT ANSWERS
Frequently asked questions
What is the Danzell question set?
Danzell is the name of the Cyber Essentials self-assessment question set introduced in April 2026, replacing the previous set named Willow. It accompanies Requirements for IT Infrastructure version 3.3.
When did the 2026 Cyber Essentials requirements take effect?
The updated requirements apply to assessment accounts created from late April 2026 onwards. Assessments registered before the changeover continue under the previous Willow question set, so organisations partway through are not affected mid-process.
What are the automatic fail questions in Cyber Essentials?
Two areas now carry automatic failure: multi-factor authentication on cloud services, and applying critical security updates within 14 days. Failing either ends the assessment regardless of performance elsewhere.
Does Cyber Essentials require MFA on every account?
Multi-factor authentication is required on cloud services, and enforcement is what is assessed rather than availability. Policies that apply only to administrators, exempt trusted locations, or sit in report-only mode are unlikely to satisfy the requirement.
Do I need to recertify if I was certified under the old question set?
Existing certificates remain valid for their twelve-month term. Recertification after that point uses whichever question set is current at the time, so the 2026 requirements will apply at your next renewal.
