Cyber Essentials is the UK government’s baseline cyber security certification scheme. If you hold it, it means your business has been assessed against five core security controls — and those controls, when properly implemented, protect against the majority of common cyber attacks. The scheme is managed by the National Cyber Security Centre (NCSC) and updated periodically to keep pace with how the threat landscape is changing.
The 2026 update — formally called the Montpellier revision — introduces several important changes that businesses need to be aware of, whether they’re applying for the first time or coming up for renewal. Some changes are straightforward clarifications. Others will require businesses to make practical changes to their setup before they can pass assessment.
A quick recap: what Cyber Essentials actually tests
The scheme is built around five technical controls that, taken together, protect against the most common attack methods. Think of it as a security MOT — it won’t catch everything, but it closes the most obvious gaps.
- Firewalls — protecting the boundary between your network and the internet
- Secure configuration — devices set up correctly, default passwords changed, unnecessary features disabled
- User access control — staff only have access to what they actually need
- Malware protection — active, up-to-date protection on all devices
- Patch management — software kept up to date within defined timeframes
These five controls haven’t changed in the 2026 revision. What has changed is what “meeting the standard” means in practice for several of them.
The key changes in the 2026 revision
Patch windows tightened further
In previous versions of the standard, businesses had 14 days to apply critical patches. The 2026 revision introduces a two-tier approach: patches classified as critical must be applied within 14 days as before, but patches where a known exploit is already in active use in the wild must be applied within 48 hours.
This matters because “known exploited vulnerabilities” are tracked publicly by bodies like CISA (the US Cybersecurity and Infrastructure Security Agency) and the NCSC. If a vulnerability appears on these lists, you have 48 hours. For businesses running manual patch management processes, this is almost impossible to meet consistently.
What this means practically: If you’re relying on your team to manually check for and apply updates, the 2026 revision will catch you out. Automated patch management via an RMM (Remote Monitoring and Management) platform is no longer just a nice-to-have — for any business that wants to hold or renew Cyber Essentials, it’s effectively a requirement.
Cloud services now explicitly in scope
Previous versions of the standard focused primarily on on-premise infrastructure — the physical devices and servers in your office. Many businesses interpreted this to mean their cloud services (Microsoft 365, Google Workspace, cloud-hosted applications) were out of scope for the assessment.
The 2026 revision makes clear that cloud services used by your business are in scope. If your staff use Microsoft 365, the security configuration of that environment — MFA enforcement, admin account controls, external sharing settings — will be assessed. This is a significant change for organisations that have focused purely on their on-premise infrastructure.
Multi-factor authentication requirements expanded
MFA — requiring a second check (usually a phone code) in addition to a password — was already required for administrator accounts and remote access. The 2026 revision extends this requirement to all cloud services accessible from the internet. That means if your staff can access your Microsoft 365 email from a web browser, MFA must be enforced for all users, not just admins.
If you’re using Microsoft 365 Business Premium (which we recommend to most clients), enforcing MFA for all users takes about 20 minutes to configure. If you’re on a lower licence tier, you can still enforce MFA — it just involves a slightly different process. Either way, it’s one of the quickest wins available in cyber security and now a formal requirement for Cyber Essentials.
Who needs Cyber Essentials?
Cyber Essentials is mandatory if you want to bid for UK government contracts that involve handling sensitive data. It’s also increasingly required by larger businesses as a condition of joining their supply chain — if you supply services or products to a large company, there’s a good chance they’ll ask for it.
Even if neither of those situations applies to you right now, the certification serves a couple of useful purposes. First, it forces you to actually address the most common security gaps rather than just intending to address them at some point. Second, it sends a clear signal to clients and prospects that you take data security seriously — which matters more and more as data protection awareness increases.
Getting certified doesn’t make you permanently secure. The certification tests your setup at a single point in time and is valid for 12 months. New devices, new staff, new software, and new cloud services can all introduce gaps after your assessment. Maintaining the standard requires ongoing attention — which is exactly why it’s included in our managed IT support packages.
What to do if your renewal is coming up
If your Cyber Essentials certificate expires in the next three months, we’d strongly recommend getting a pre-assessment review done before you submit. The 2026 changes — particularly around cloud services and MFA — mean that setups which passed last year might not pass under the updated requirements without some remediation work.
Failing the assessment and resubmitting costs money and, more practically, leaves you without a valid certificate during the gap — which could be a problem if a contract or procurement process requires one.
BOOM I.T. helps Yorkshire businesses prepare for, achieve, and maintain Cyber Essentials certification. If you want to know where your current setup stands against the updated requirements, call us on 03333 660 005. We’ll give you a straight answer.