Cyber Essentials has evolved again, and while the latest changes may seem modest on the surface, they signal something much bigger for UK businesses.
The 2026 updates raise the bar on what is expected from organisations seeking certification. Most notably, they reinforce the importance of Multi-Factor Authentication (MFA) and make it clear that basic cyber security controls must be actively used, not simply available.
For SMEs, this is more than just another compliance update. It’s a reflection of how modern cyber attacks are happening and where businesses remain most vulnerable.
A quick reminder: what is Cyber Essentials?
Cyber Essentials is a UK Government-backed cyber security certification designed to help organisations protect themselves against the most common cyber threats.
It focuses on five key areas:
- Firewalls and internet gateways
- Secure configuration
- User access control
- Malware protection
- Security update management
For many businesses, Cyber Essentials starts as a requirement from a customer, supplier, insurer or tender process. However, the real value lies in reducing cyber risk and ensuring the basics are being done well.
The biggest change: MFA is no longer optional
The most significant takeaway from the 2026 updates is the increased emphasis on Multi-Factor Authentication.
In simple terms, if a cloud service offers MFA, it needs to be enabled.
That matters because passwords remain one of the biggest weak points in business security. They get reused, guessed, stolen, shared and exposed through phishing attacks every day.
A password on its own is no longer enough.
MFA adds an extra layer of protection by requiring a second method of authentication, such as:
- A notification on your phone
- Microsoft Authenticator approval
- A security key
- Biometric authentication
Even if a criminal obtains a password, they are unlikely to have access to that second factor.
Why this matters to SMEs
One of the biggest misconceptions we hear is:
“We’re too small to be targeted.”
The reality is quite the opposite.
Cyber criminals are increasingly targeting smaller businesses because they often have fewer security controls in place than larger organisations. Most attacks are automated. Attackers aren’t choosing businesses individually; they’re looking for easy opportunities.
A compromised Microsoft 365 account can give an attacker access to:
- Emails
- SharePoint files
- Teams conversations
- Customer information
- Financial data
We’ve seen numerous examples across the industry where a single compromised account has led to fraudulent payments, data breaches or operational disruption.
In many cases, MFA would have prevented the attack entirely.
Cloud services are now under greater scrutiny
Another notable change is the clarification around cloud services.
Today, most SMEs rely heavily on cloud platforms such as:
- Microsoft 365
- SharePoint
- Teams
- Xero
- CRM platforms
- Industry-specific business applications
The updated Cyber Essentials requirements make it clear that these systems form part of your security responsibility and cannot simply be overlooked during certification.
For business owners, the message is straightforward: if critical business data lives in the cloud, its security matters just as much as the devices in your office.
The direction of travel is clear
The latest updates continue a trend we’ve seen over recent years.
Cyber Essentials is moving away from being a simple questionnaire and towards demonstrating that security controls are genuinely implemented and working.
That’s good news for businesses.
Why?
Because the controls being assessed are not arbitrary. They are the same fundamentals that help prevent the majority of common cyber attacks.
Strong passwords. MFA. Secure devices. Up-to-date systems. Controlled access.
These are not advanced security measures. They are the foundations of a secure business.
What should SME owners do now?
If your business already has Cyber Essentials certification, now is a good time to review your environment and ensure MFA is enabled wherever possible.
If you’re not currently certified, don’t view these changes as a reason to delay. Instead, see them as an opportunity to strengthen your security before an issue arises.
Ask yourself:
- Is MFA enabled on Microsoft 365?
- Do all staff use it consistently?
- Are cloud applications protected?
- Are former employees removed promptly from systems?
- Are devices and software kept up to date?
If you’re unsure of the answer to any of these questions, it’s worth investigating before your next certification renewal.
Cyber Essentials is about more than compliance
At Press Start, we believe Cyber Essentials should never be treated as a box-ticking exercise.
Certification is valuable, but the real benefit is the reduction in risk that comes from implementing the underlying controls properly.
The 2026 changes reinforce a simple but important message:
Cyber security basics matter more than ever.
For SME businesses, enabling MFA across your organisation may be one of the quickest, simplest and most effective security improvements you can make.
And if Cyber Essentials encourages more businesses to take that step, that’s a positive development for everyone.
