Cyber Essentials v3.3 takes effect 27 April 2026. Cloud services now mandatory in scope, MFA is a hard fail, and stricter scoping rules apply. Complete guide to compliance.
From 27 April 2026, Cyber Essentials is getting its biggest overhaul in years. Version 3.3, delivered through the new "Danzell" question set, closes loopholes that have let businesses pass with creative scoping and informal processes.
If your certification expires after April, or you're bidding for contracts that require Cyber Essentials, this guide walks you through exactly what's changing and what you need to fix before the deadline.
The rule: If a cloud service stores or processes your organisation's data, it must be included in your Cyber Essentials scope. Cloud services cannot be excluded.
What this means:
The trap: "We only use it for marketing emails" is no longer a valid exclusion. If any company data flows through a service, even temporarily, it's in scope.
What's new: Previous versions allowed some ambiguity around cloud services. v3.3 makes it explicit - there's no opt-out path for cloud services that handle organisational data.
The rule: If a cloud service offers MFA in any form (built-in, free, add-on, or via an identity provider) and you haven't enabled it, your assessment fails immediately.
What this means:
This includes:
What's new: MFA was strongly recommended in previous versions. v3.3 makes it mandatory where available. The guidance explicitly states: "Any multi-factor authentication is better than not having it at all."
Technical detail: Password-only authentication for cloud services is now a fail condition. If the service offers MFA (even as a paid add-on), you must enable it or fail the assessment.
The rule: Any device, service, or network segment that can reach the internet, or access data in scope, is very likely to be pulled into your Cyber Essentials scope.
What this means:
The trap: You can't exclude remote work arrangements through creative scoping anymore. If employees access company systems from home on personal devices, those devices need to be managed and secured to Cyber Essentials standards.
What's new: Previous versions used language about "untrusted connections" which created grey areas. v3.3 tightens this to focus on internet connectivity and data access, making scoping decisions much clearer.
Specific guidance on scope:
The rule: v3.3 strengthens requirements around secure application development, patching high-risk vulnerabilities within 14 days, and basic SDLC controls for in-house or heavily customised applications.
What this means:
All need documented secure development processes, change control, and vulnerability patching regimes.
The trap: That internal tool your developer built five years ago, or the Airtable base that's become critical to operations - if there's no documented secure development process or patching regime, you'll be flagged as non-compliant.
What's new: v3.3 references the NCSC's Software Security Code of Practice and requires organisations to demonstrate they're following commercial best practices for development and testing.
The rule: All software must be updated, including vulnerability fixes, within 14 days of release where:
What this means:
The trap: "We test patches before deployment" is valid, but your testing window can't exceed 14 days for critical vulnerabilities. Some organisations will need to speed up their change management processes.
What's new: Previous versions recommended timely patching. v3.3 makes the 14-day window explicit and tied to CVSS scoring.
The rule: Password requirements now depend on whether MFA is in place.
With MFA:
Without MFA:
Other requirements:
What's new: The guidance moves away from complexity requirements and password expiry toward longer passwords and better tooling (password managers).
Based on early assessments under the Danzell question set, here are the issues catching businesses out:
The scenario: Marketing uses Mailchimp. Finance uses an online invoice tool. HR uses a separate recruitment platform. None of these were documented in the last Cyber Essentials assessment because "they're just departmental tools."
Why this fails now: If company data flows through these services, they're in scope. You need to identify them, document them, show shared responsibility understanding, and confirm MFA is enabled.
The fix:
The scenario: Your Microsoft 365 global admin account still uses password-only authentication. Or your Xero account. Or your Salesforce admin login.
Why this fails now: If the service offers MFA and you haven't enabled it, immediate fail. No exceptions.
The fix:
The scenario: When the pandemic hit, you told staff to work from home. Some use personal laptops. Some use company laptops but haven't received security updates in months. There's no formal policy for securing home work environments.
Why this fails now: Any device accessing company systems is in scope. If those devices aren't patched within 14 days, don't have software firewalls enabled, or aren't meeting secure configuration standards, you fail.
The fix:
The scenario: You built an internal dashboard five years ago. Or you use Airtable extensively as a custom CRM. Or you have a bespoke project management tool. None of these have documented secure development processes, change control, or vulnerability management.
Why this fails now: v3.3 requires documented SDLC controls for bespoke and heavily customised applications. If you can't show secure development practices, change control, and vulnerability patching processes, you'll be flagged.
The fix:
v3.3 makes the shared responsibility model explicit. Who implements which control depends on the type of cloud service:
Examples: AWS EC2, Google Compute Engine, Rackspace
Your organisation is responsible for:
Cloud provider is responsible for:
Examples: Azure Web Apps, AWS Lambda, Heroku
Your organisation is responsible for:
Cloud provider is responsible for:
Examples: Microsoft 365, Google Workspace, Salesforce, Xero
Your organisation is responsible for:
Cloud provider is responsible for:
Critical requirement: You must confirm the cloud provider has committed to implementing their controls via contractual clauses or published security statements (usually in their trust centre).
User-owned devices that access organisational data or services are in scope, with one exception:
In scope:
Out of scope:
If your organisation supplies the home router: That router is in scope and must meet firewall requirements.
If the worker uses their own ISP router: The router is out of scope, but you must apply firewall controls (software firewalls) on user devices.
If remote workers use a corporate VPN: Their internet boundary is at your company firewall or virtual/cloud firewall, simplifying device management.
1. Cloud Service Audit
2. MFA Status Check
3. Remote Work Inventory
4. Bespoke Application Review
1. Enable MFA Everywhere
2. Formalise Remote Work Policies
3. Document Bespoke Application Security
4. Review Scoping Decisions
1. Test Patch Management
2. Review Password Policies
3. Document Everything
4. Pre-Assessment Review
□ CLOUD SERVICES
□ All cloud services identified and documented
□ Shared responsibility understood for each service
□ MFA enabled on all cloud services where available
□ Admin accounts have MFA enabled
□ Finance system accounts have MFA enabled
□ REMOTE WORKING
□ All remote workers documented
□ BYOD policy defined and enforced
□ Software firewalls enabled on all remote devices
□ Patch management covers remote devices
□ 14-day patching monitored and enforced
□ PASSWORDS & AUTHENTICATION
□ Minimum password length: 12 chars (no MFA) or 8 chars (with MFA)
□ Password expiry removed
□ Complexity requirements removed
□ Brute-force protection enabled
□ Password managers provided to users
□ BESPOKE APPLICATIONS
□ All internal tools and customised apps identified
□ Secure development process documented
□ Change control procedures in place
□ Vulnerability management process defined
□ 14-day critical patch commitment documented
□ SCOPING
□ Scope boundary clearly defined
□ Any exclusions justified and documented
□ All internet-connected devices included
□ All devices accessing organisational data included
□ PATCH MANAGEMENT
□ All software licensed and supported
□ Unsupported software removed or isolated
□ Automatic updates enabled where possible
□ Critical/high patches applied within 14 days
□ Monitoring in place to track compliance
□ FIREWALLS
□ All devices protected by firewall
□ Default passwords changed
□ Admin interfaces protected (MFA or IP allowlist)
□ Unnecessary firewall rules removed
□ Firewall rules documented with business justification
□ USER ACCOUNTS
□ Process to create and approve accounts
□ Unused accounts removed
□ Administrative accounts used only for admin tasks
□ Special privileges removed when no longer needed
□ Third-party accounts included in scope
Many government contracts and private sector procurement processes require Cyber Essentials certification. If your certification expires after April 2026, you'll need to pass under v3.3 rules to maintain your certification and continue bidding.
Businesses that adapt early have a competitive edge. While your competitors scramble to meet new requirements in March 2026, you'll already be compliant and able to demonstrate mature security practices to clients.
v3.3 closes real security gaps. The tighter scoping, mandatory MFA, and stricter patch management directly reduce your risk of successful cyber attacks. This isn't just box-ticking - these controls prevent breaches.
Cyber insurance providers increasingly require Cyber Essentials certification. Some policies explicitly require MFA and may void coverage if you're breached through a password-only account. v3.3 alignment makes insurance discussions simpler.
27 April 2026. All assessments from this date will use v3.3 requirements.
No. If your certification expires after 27 April 2026, your renewal assessment will be against v3.3.
You can delay your assessment, but this leaves you without valid certification. If you need Cyber Essentials for contracts, you can't afford gaps in certification.
This is rare. Most modern cloud services offer MFA, even if it's a paid add-on. If a service genuinely doesn't support MFA, document this and be prepared to justify why you're using a service without this basic security control.
The 14-day requirement applies to critical and high-risk vulnerabilities. You need processes that allow testing and deployment within this window. If your current change management can't meet this, you'll need to streamline it.
Not necessarily. You can use MDM, but alternatives include:
Choose the approach that fits your organisation and meets the security requirements.
You'll need to document secure development practices for each one. For older applications built before these requirements existed, create retrospective documentation. If applications can't meet security standards, consider whether they should be rebuilt or replaced.
Publicly available commercial web applications are in scope by default. However, bespoke and custom components can be excluded if you can demonstrate robust development and testing processes.
We work with London businesses to achieve Cyber Essentials certification without the stress, guesswork, or nasty surprises at audit time.
Our approach:
We've already taken businesses through early v3.3 assessments under the Danzell question set. We know exactly where the new failure points are, which scoping questions catch people out, and how to fix gaps before they become problems.
If your renewal date is close to April and you're unsure whether you'll pass under v3.3, let's talk now - not after an avoidable failure that costs you time, money, and contract opportunities.
Get in touch: hello@stabilise.io - +44 203 355 7522
Cyber Essentials v3.3 comes into force on 27 April 2026. The question isn't whether you'll need to comply. It's whether you'll be ready when the deadline hits.
