Cyber Essentials v3.3 went live on 27 April 2026. If your business holds the certification, the rules you passed last year no longer apply. If you don’t have certification, it’s time to rethink this.
Only 5% of UK businesses hold Cyber Essentials, yet 43% reported a cyber breach or attack in the last year. If your business is still treating Cyber Essentials as a form that never gets filled, you are already behind and missing out.
So, with the new v3.3 essentials, what is expected if your business wants certification, needs to meet supply chain requirements, or wants a more credible cybersecurity baseline?
Why Cyber Essentials matters
Cyber Essentials is now asking whether your business can stand up better when something goes wrong. Assuming you can, certification gives you a competitive advantage and a stronger position to win and retain business. This certification also indicates to customers and suppliers that you’re a safe and compliant company.
Investing in Cyber Essentials can help your business reduce risks and win more business. This is about reducing commercial exposure and increasing opportunity.
If you rely on Cyber Essentials to support tenders, reassure customers, strengthen insurance conversations or to prove your house is in order, the new standard leaves less room for fuzzy scope, loose identity controls or half-managed cloud services.
What is Cyber Essentials?
Cyber Essentials (CE) is a UK Government-backed scheme that certifies a baseline of technical security to protect businesses from 80-90% of internet threats, reducing insurance premiums and winning customer trust, amongst other benefits.
What’s changed?
Arguably the biggest shift is that cybersecurity patching now has to be evidenced within 14 days of release. If you can’t prove you’ve patched that security update, then you fail. Importantly, under CE Plus, if a second sample fails, then your level 1 basic certificate is revoked. Back to square one. This means every device must be tested for vulnerabilities. This has significant consequences and impact.
Under v3.3, cloud services are now formally defined and, if they store or process your organisation’s data, they are in scope. Think CRM systems, finance platforms, Microsoft 365. That matters because many SMEs still think Cyber Essentials is mainly about office devices and firewalls, when a large share of business risk now sits in Microsoft 365, SaaS platforms and remote access.
Multi-Factor Authentication (MFA)
Multi-Factor Authentication is the second flashpoint. Where a cloud service supports multi-factor authentication, it now needs to be enabled. IASME’s guidance is clear that failing to turn on MFA where available can cause the assessment to fail. You also need to be able to demonstrate it during any assessment.
Remote devices and BYOD are now in scope unless you can justify exclusions. Worth noting the National Cyber Security Centre (NCSC) also makes clear that a scope without end-user devices is not acceptable.
Why this matters to SMEs
Only 5% of UK businesses hold Cyber Essentials. Among small businesses, the figure is 12%. So, most firms are still outside the baseline entirely, and are either uncertified, under-prepared, or still relying on assumptions that the updated framework is less willing to tolerate.
And the wider risk picture is not improving enough to be relaxed about it. The UK government’s latest survey says 43% of businesses experienced a cyber breach or attack in the last 12 months. So, the gap between risk and readiness is still far too wide.
How not to get caught out?
Usually, it’s not one dramatic security failure. It is the accumulation of small blind spots.
Check for any un-scoped Cloud services and apps, MFA not switched on everywhere, or devices still connecting to business data that nobody wants to count. Review backups and check your data recovery process has been tested and works. That is where we find SMEs tend to get exposed under tighter rules.
In plain English, the businesses most likely to struggle are not necessarily reckless; they’re busy growing, but their systems have drifted, and Cyber Essentials is now less forgiving of drift and has closed several gaps.
How can my business get on top of CE?
Start with a thorough scope of your services. Here at commited, we can help with this. We’ll analyse your systems and identify which users, devices, cloud services and applications genuinely sit inside your Cyber Essentials boundary.
We can also check MFA across every cloud platform you rely on and review patching, backups, and recovery. We’ll also apply this same careful process to your firewall and antivirus settings.
The most important factor to stay on top of cybersecurity is to stop treating Cyber Essentials as a once-a-year compliance exercise. For MDs and FDs, this is a control issue. If the updated standard exposes weakness, the weakness was already there. The certification just forced it into the open.
Not sure whether your current setup would stand up to the new Cyber Essentials rules?
If your certification is due for renewal within 6 months, speak to us; we can help you become compliant, or book a no-obligation cyber risk review.
Newsletter
Subscribe for monthly IT advice and a chance to get Co-Op Live tickets.