Cyber Essentials 2026: What’s New in v3.3, and the Rules That Catch Renewals Out

What is genuinely new in v3.3

The NCSC lists these changes in version 3.3 of its requirements:

• A definition of “cloud services”.
• An updated definition of passwordless sign-in that includes FIDO2 (passkeys).
• A definitive statement that cloud services cannot be excluded from scope.
• A Software Security Code of Practice, in the software development section.
• Scope criteria that no longer refer to “untrusted connections”.
• More emphasis on backing up data — still recommended, not required.

IASME’s question set made one practical change too: for laptops, desktops, phones and tablets you no longer have to list the model — the make and operating-system version are enough (A2.6). Everything below is not new, but these are the rules that most often catch businesses out.

1. MFA on every cloud account — an automatic fail

This is the big one. Every user and admin account on every cloud service that offers multi-factor authentication (MFA) must have it on — everyone, not just admins. A single account without MFA fails the entire user-access section automatically. There’s no partial credit and no warning.

The catch most businesses miss: it’s rarely that they have no MFA — it’s that they missed it somewhere. A shared mailbox. The company social media logins. A finance tool someone set up years ago. (We cover this in detail in the MFA guide.)

2. Patching runs on a strict 14-day clock — and it’s an automatic fail

High-risk and critical security updates — and security updates the vendor gives no severity rating — must be applied within 14 days of the vendor releasing them, across operating systems, applications, browsers and firmware. Miss it, and that’s an automatic fail. The trap: the clock starts when the vendor publishes the fix, so the common “we update everything once a month” routine can quietly miss the window.

3. Out-of-date software is a straight fail

If a device in scope is running an operating system that’s no longer supported — the obvious example being Windows 10 after its October 2025 end of support, without Extended Security Updates — that’s a categorical fail. The only fix is to update, replace, or formally remove the device.

4. You can’t quietly leave your cloud tools out

Microsoft 365, Google Workspace, your accounting software, your CRM, file storage — even business social media accounts — all count, and you cannot exclude them to make the assessment easier — v3.3 now says so definitively. How you’ve configured them (especially their MFA settings) is your responsibility.

5. Your devices — including personal phones — are in scope

A scope that leaves out laptops, desktops, tablets and phones isn’t acceptable. And a personal phone counts if it’s used for work email or files (it’s only exempt if it’s used purely for the phone’s built-in calls and texts, or two-factor codes). For home workers, a router your business supplied is in scope; their own broadband router is not, and the laptop’s software firewall is relied on instead. The scope guide has worked examples.

6. The password rules are simpler than most policies

Password quality must be managed by one of three technical controls: MFA; a minimum of 12 characters; or a minimum of 8 characters plus automatic blocking of common passwords. Forced expiry and complexity rules aren’t required — the requirements advise against both. Logins still need protection against guessing: MFA, throttling (no more than 10 guesses in 5 minutes), or lockout after no more than 10 attempts. If your policy still says “change every 90 days, include a symbol”, it is out of date — see the password requirements guide.

Where each rule lives in the questionnaire

• MFA: A7.14 (which services offer it), A7.15 (any that genuinely don’t — listing one that does is an automatic fail), A7.16 (every admin), A7.17 (every user).
• 14-day updates: A6.4 for operating systems and firmware, A6.5 for applications — both automatic fails. A6.4.1 and A6.5.1 ask whether updates are automatic.
• Unsupported software: A6.1 (operating systems — automatic fail), A6.2 and A6.3 (applications and licensing), A6.6 and A6.7 (removed or walled off).
• Scope: section A2 — locations, home workers, routers with models, devices with operating-system versions, servers, every cloud service.
• Passwords: A4.3 (firewall admin), A5.3 (device defaults), A7.10 and A7.11 (accounts).

What did not change

The five controls are the same five. The certificate still lasts twelve months. The basic level is still a self-assessment with typed answers; you don’t normally upload evidence, though your certification body can ask for it. Backups are still not a requirement, even with the new emphasis on them. Only IASME-licensed certification bodies award it.

The pattern behind all of this

The questionnaire still assumes you have an IT team, and the question set is updated roughly once a year — so “what we answered last year” is not a safe assumption. The single most avoidable mistake is working from last year’s understanding instead of the current rules.

What to do about it

• Work from the current question set, not last year’s.
• List every online tool your team uses, and check MFA is on for each — including the accounts nobody thinks about.
• Check no device is on unsupported software.
• Switch on automatic updates everywhere, so the 14-day rule looks after itself.
• Rewrite any password policy that still forces expiry or complexity.
• If you are renewing, read the renewal guide and start four to six weeks before expiry.