Will I fail Cyber Essentials under the 2026 rules?

You will if any of your cloud services, such as email, accounting or file storage, can be signed into without two-step sign-in where the service offers it. For assessments started after 27 April 2026, that's an automatic fail. The good news is that for most small businesses it's a setting you can switch on in an afternoon.

What changed in Cyber Essentials in 2026?

The requirements and questions for Cyber Essentials are updated from time to time. The 2026 update (version 3.3, with a question set known as “Danzell”) applies to assessment accounts created after 27 April 2026. You then have six months to complete the assessment. If you opened your account before 27 April, you’re assessed on the previous questions (IASME: April 2026 changes).

The change that matters most for small businesses:

Two-step sign-in (MFA) on cloud services is now an automatic fail if it’s missing. If a cloud service you use for work offers two-step sign-in, whether it’s free, included or a paid extra, and you haven’t turned it on, the assessment fails (IASME). MFA (multi-factor authentication) means signing in needs a code from your phone, an app or a passkey as well as your password.

Other points to check:

Security updates that fix critical or high-risk problems must be installed within 14 days of release (NCSC: Cyber Essentials requirements v3.3). Switching on automatic updates is the easiest way to meet this.
Unsupported software is an automatic fail: anything no longer getting security updates from its maker, such as an old version of Windows (IASME FAQ).
A board member or director signs the declaration, confirming the answers are true.

Are there any automatic fail questions?

Yes. Using unsupported software fails the assessment (IASME FAQ), and under the 2026 rules so does missing two-step sign-in on cloud services. That second one is the most likely to catch out a small business. Read the current question set on the IASME website before you apply.

If you do fail, you don’t always have to start again. IASME gives you two working days to read the assessor’s feedback, fix simple issues and update your answers, at no extra charge. If you still fail after that, you have to reapply and pay again (IASME FAQ).

Which of my services count as “cloud services”?

Anything your business signs in to over the internet. For a typical small business that includes:

your email and office apps (Google Workspace or Microsoft 365)
accounting software
your website builder or hosting account
your domain registrar
customer, booking and project tools
online banking (check what your bank offers)

Make a list. For each one, find the security settings and check two-step sign-in is turned on for every person who uses it, not just you.

Google Workspace

Sign in to the Google Admin console (admin.google.com) as an administrator.
Go to Security › Authentication › 2-step verification.
Tick Allow users to turn on 2-step verification and save.
Ask everyone to set it up in their Google Account under Security, ideally using the Google prompt on their phone or a passkey.
Once everyone has it set up, come back and set Enforcement to On, so nobody can sign in without it (Google: deploy 2-Step Verification).

Microsoft 365

For most small businesses, the simplest option is security defaults, which turns on two-step sign-in for everyone:

Sign in to the Microsoft Entra admin centre (entra.microsoft.com) as an administrator.
Go to Entra ID › Overview › Properties, then Manage security defaults.
Set security defaults to Enabled and save.
Everyone will be asked to set up the Microsoft Authenticator app the next time they sign in.

If you have Microsoft 365 Business Premium and use Conditional Access policies instead, you can’t turn security defaults on while any policy exists (Microsoft). Make sure your policies require two-step sign-in for every user.

What about everything else Cyber Essentials checks?

Two-step sign-in is the most common new stumbling block, but it isn’t the only one. You’ll also need updates switched on, unsupported software removed, sensible admin accounts and malware protection. Our guide A client has asked for Cyber Essentials. Do I need it? covers the five areas, and the NCSC’s free Cyber Action Toolkit is a good way to work through them.

Remember that Cyber Essentials is renewed every year. If you certified under the old questions, your next renewal will use the new set.