Contact 
Cyber Essentials is evolving, and with the release of version 3.3 in April 2026, the certification is becoming more rigorous, more explicit, and more aligned with today’s threat landscape.
While the five core security controls remain unchanged, the way they are interpreted, applied, and assessed has significantly tightened. The result? A higher bar for organisations seeking certification or renewal.
In this article, we break down the key updates and what they mean in practice.
Why the Changes Matter
Cyber threats have shifted dramatically in recent years. Organisations are increasingly operating in cloud-first environments, while attackers are focusing more on identity-based attacks, credential theft, and misconfigured systems.
Cyber Essentials v3.3 reflects this reality. The scheme is no longer just about having controls in place; it’s about proving they are fully implemented, consistently applied, and effective across your entire environment.
Key Changes in Cyber Essentials v3.3
1. Cloud Services Are Now Clearly In Scope
One of the most significant updates is the removal of ambiguity around cloud services.
Previously, organisations often struggled with whether certain SaaS platforms or cloud-hosted systems needed to be included. That grey area is now gone.
What’s changed:
- Cloud services are explicitly in scope where they process or store organisational data
- Responsibility is shared, but not avoided (you still own configuration and access control)
What this means:
You must now account for platforms like Microsoft 365, Google Workspace, cloud hosting environments, and SaaS tools within your Cyber Essentials scope.
2. Multi-Factor Authentication (MFA) Is Mandatory
MFA is no longer a “best practice”, it’s a requirement.
If MFA is available on a system and not enabled, it can now result in an automatic failure.
What’s changed:
- Stronger enforcement of MFA across remote access, admin accounts, and cloud services
- Less tolerance for partial or inconsistent implementation
What this means:
Organisations must ensure MFA is:
- Enabled everywhere it is supported
- Consistently enforced across users and systems
- Not limited to just “high-risk” accounts
3. Stronger Scoping Expectations
Scoping has always been a critical part of Cyber Essentials, but it’s now under much closer scrutiny.
What’s changed:
- Internet-connected systems are assumed to be in scope by default
- Any exclusions must be clearly justified and supported by robust network segregation
What this means:
You can no longer rely on loosely defined scopes. If systems can interact with the internet or with in-scope systems, they are likely to be included.
Clear documentation and technical controls (such as firewalls and segmentation) are essential.
4. Increased “Auto-Fail” Criteria
The updated standard places greater emphasis on real-world implementation, not just policy or intent.
What’s changed:
- More scenarios that lead to automatic failure
- Focus on practical security outcomes, including:
- Patch management
- Secure configuration
- Authentication controls
What this means:
It’s not enough to say controls exist. They must be:
- Actively enforced
- Up to date
- Consistently applied across all relevant systems
What This Means for Your Organisation
For most organisations, the challenge isn’t introducing entirely new controls, it’s demonstrating maturity.
Cyber Essentials v3.3 expects:
- Consistency across all users, devices, and services
- Visibility of your full IT and cloud estate
- Evidence that controls are working as intended
This is particularly important in environments that have grown organically or adopted cloud services rapidly.
Preparing for Certification or Renewal in 2026
If you’re planning to achieve or renew Cyber Essentials certification this year, now is the time to act.
Focus on the following areas:
Review Your Scope
Ensure all relevant systems, especially cloud services, are included and properly documented.
Assess MFA Coverage
Identify gaps and ensure MFA is enforced wherever available.
Validate Your Controls
Check that patching, configurations, and access controls are consistently applied across your environment.
Test Your Assumptions
Don’t rely on policy alone; verify that controls are working in practice.
Final Thoughts
Cyber Essentials v3.3 represents a natural but important evolution of the scheme. It reflects how organisations actually operate today, and how attackers are targeting them.
The organisations that succeed won’t necessarily be those with the most controls, but those with the clearest visibility, strongest consistency, and best evidence of implementation.
Need Support?
If you’re unsure how these changes impact your organisation or want a second pair of eyes on your readiness, we’re here to help. Contact our team today via info@i3secure.co.uk.
