The Cyber Essentials MFA Rule That Catches Businesses Out in 2026

What the rule actually says

Multi-factor authentication — that’s the extra step where you confirm a login with a code on your phone or an app — is mandatory on every account on your cloud services, wherever the service offers it. Not just administrators. Everyone.

And it isn’t scored gently. One in-scope account without MFA fails the entire user-access control section. No partial marks.

The four questions, and where the trap is

In the 2026 question set MFA is not one question but four, and the structure matters because it is where people fail without noticing:

• A7.14 asks whether all the cloud services you use offer MFA. For almost every mainstream tool — Microsoft 365, Google Workspace, Xero, QuickBooks, Dropbox, Slack, the social networks — the answer is yes.
• A7.15 asks you to list any service that genuinely has no MFA option. This is the trap: if you list a service here that actually does offer MFA, that is an automatic fail. “We didn’t know it had it” counts as listing it wrongly. Check the service’s security settings before you write anything here, and expect the list to be empty or nearly so.
• A7.16 asks whether MFA is on for every administrator of every cloud service. No means fail.
• A7.17 asks whether it is on for every other user. No means fail.

Where MFA is used, the password element must itself be at least 8 characters. Passkeys and hardware security keys count as MFA. Text-message codes are allowed but discouraged.

Why businesses that “have MFA” still fail

Here’s the part that catches people out. A common pattern: MFA is on for the main accounts, but missed somewhere less obvious. The usual culprits:

• Shared mailboxes (info@, accounts@). If several people sign in with one shared password, that breaks the unique-login rule too (A7.2) — give each person access through their own MFA-protected account.
• Business social media accounts — LinkedIn, Facebook, Instagram, X. These count as cloud services and need MFA too.
• Finance and accounting tools set up years ago and rarely touched.
• Service or admin accounts created during a software setup and forgotten.
• That one app a single team member uses that nobody else thinks about.

If the service offers MFA and it’s switched off, that’s a fail — even if every “normal” account is covered.

What counts as MFA

• An authenticator app (Microsoft Authenticator, Google Authenticator) — recommended.
• A passkey or hardware security key (FIDO2) — these count.
• A code by text message — allowed, but increasingly discouraged in favour of apps.

How to fix it: the checklist

1. List every online tool your team logs into. All of them — email, accounting, CRM, file storage, marketing tools, social media. This is the step people skip, and it’s where the hidden gaps live.
2. Check MFA is on for each one. Log in and look at the security settings.
3. Pay special attention to shared and forgotten accounts — the ones above.
4. Turn MFA on wherever it’s off, ideally using an authenticator app.

It’s genuinely not difficult once you can see the full list — the hard part is knowing every account you need to check.

Switching it on, tool by tool

Every mainstream service puts MFA in roughly the same place — your account’s security settings — and most take under ten minutes per person. A few worth knowing:

• Microsoft 365: each person adds an authenticator app under their account’s “Security info”; an admin can then require it for everyone by turning on security defaults (or a Conditional Access policy) in the Microsoft Entra admin centre. One login covers Outlook, Teams, OneDrive and SharePoint.
• Google Workspace: “2-Step Verification” under each person’s Google account security, enforced for the whole organisation from the admin console — the Google Workspace guide has the clicks.
• Xero: check that multi-factor authentication is on for every user, under Account → Multi-factor authentication.
• Social media: LinkedIn, Facebook/Meta Business, Instagram and X each have two-factor settings under security; the business accounts need them on for every person who can log in.

The full list of tools small businesses use — accounting, CRM, file storage, project tools, payments, marketing — runs to dozens. The question is not whether each one can do MFA; it is whether you have checked each one.

What to do if a service truly has no MFA

It happens, mostly with small or old niche tools. Check first whether it can sign in through Microsoft 365 or Google; if so, set that up — it then has MFA and must not be listed at A7.15. Otherwise, the honest path is to list it at A7.15 only after confirming with the provider that no MFA option exists, and to ask yourself whether the tool needs to be there at all — the assessor may ask the same. Do not list a service there because you could not find the setting; that is the fast route to an automatic fail.

The bottom line

The MFA rule isn’t there to catch you out — it’s the single most effective thing a small business can do to stay secure. But because it’s an automatic fail, one overlooked account can cost you the certificate. The fix is simple; the trick is making sure nothing’s missed.