---
title: "Cyber Essentials 2026: MFA Rules, Cloud Scope & Compliance"
description: Stay updated with Cyber Essentials 2026's MFA rules, cloud service definitions and compliance strategies to enhance your organisation's cyber resilience.
image: https://blog.grantmcgregor.co.uk/hubfs/Cyber%20Essentials%202026.png
---
[](https://www.grantmcgregor.co.uk/)
- [Home](https://grantmcgregor.co.uk/)
- About Us
- [Our Story](https://grantmcgregor.co.uk/about-us/our-story)
- [Meet the Team](https://grantmcgregor.co.uk/about-us/meet-the-team)
- [Certifications](https://grantmcgregor.co.uk/about-us/certifications)
- [Careers](https://grantmcgregor.co.uk/about-us/careers)
- IT Support Services
- [IT Support Services](https://grantmcgregor.co.uk/it-support-services)
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- Professional IT Services
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Microsoft 365](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-business-premium)
- [Microsoft Copilot](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-copilot)
- [AI Adoption Services](https://grantmcgregor.co.uk/ai-adoption-services)
- [Microsoft Azure](https://grantmcgregor.co.uk/professional-it-services/microsoft-azure)
- [MDR](https://blog.grantmcgregor.co.uk/mdr-vs-soc-cyber-security-defence)
- [Microsoft Teams Phone](https://grantmcgregor.co.uk/professional-it-services/microsoft-teams-phone)
- [KnowBe4](https://grantmcgregor.co.uk/professional-it-services/knowbe4)
- [DMARC](https://grantmcgregor.co.uk/professional-it-services/dmarc)
- [Enclave Networks](https://grantmcgregor.co.uk/professional-it-services/enclave-networks)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
- Knowledge Hub
- [Case Studies](https://grantmcgregor.co.uk/knowledge-hub/case-studies)
- [Testimonials](https://grantmcgregor.co.uk/knowledge-hub/success-stories)
- [Blog](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Podcast](https://grantmcgregor.co.uk/knowledge-hub/podcast)
- [Client Area](https://grantmcgregor.co.uk/client-area)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
- [Home](https://grantmcgregor.co.uk/)
- About Us
- [Our Story](https://grantmcgregor.co.uk/about-us/our-story)
- [Meet the Team](https://grantmcgregor.co.uk/about-us/meet-the-team)
- [Certifications](https://grantmcgregor.co.uk/about-us/certifications)
- [Careers](https://grantmcgregor.co.uk/about-us/careers)
- IT Support Services
- [IT Support Services](https://grantmcgregor.co.uk/it-support-services)
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- Professional IT Services
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Microsoft 365](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-business-premium)
- [Microsoft Copilot](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-copilot)
- [AI Adoption Services](https://grantmcgregor.co.uk/ai-adoption-services)
- [Microsoft Azure](https://grantmcgregor.co.uk/professional-it-services/microsoft-azure)
- [MDR](https://blog.grantmcgregor.co.uk/mdr-vs-soc-cyber-security-defence)
- [Microsoft Teams Phone](https://grantmcgregor.co.uk/professional-it-services/microsoft-teams-phone)
- [KnowBe4](https://grantmcgregor.co.uk/professional-it-services/knowbe4)
- [DMARC](https://grantmcgregor.co.uk/professional-it-services/dmarc)
- [Enclave Networks](https://grantmcgregor.co.uk/professional-it-services/enclave-networks)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
- Knowledge Hub
- [Case Studies](https://grantmcgregor.co.uk/knowledge-hub/case-studies)
- [Testimonials](https://grantmcgregor.co.uk/knowledge-hub/success-stories)
- [Blog](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Podcast](https://grantmcgregor.co.uk/knowledge-hub/podcast)
- [Client Area](https://grantmcgregor.co.uk/client-area)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
[Contact Us](https://grantmcgregor.co.uk/contact-us)
[Back to main](https://grantmcgregor.co.uk/knowledge-hub/blog)
Cyber Security
# Cyber Essentials 2026: MFA Rules, Cloud Scope & Compliance
Grant McGregor Team
5 November 2025 • 3 min read
Although IASME has described the 2026 update as "minor," it introduced important clarifications regarding multi-factor authentication (MFA), cloud services and scoping definitions. For many organisations, this means reviewing internal policies, raising awareness of user access controls and ensuring that MFA is properly enforced across every account.
As a government-backed scheme designed to protect against the most common cyber attacks, Cyber Essentials remains one of the simplest yet most effective frameworks for building cyber resilience.
The 2026 update reinforces the importance of getting the security fundamentals right and keeping them up to date as requirements evolve.
# MFA is now an automatic pass or fail
Multi-factor authentication has long been a Cyber Essentials requirement.
Under the 2026 requirements, MFA must be enabled for cloud services wherever it is available.
If it is available but has not been implemented, the organisation will automatically fail the assessment. No exceptions.
With credential-based attacks continuing to pose a threat, IASME emphasises MFA as an important additional layer of protection.
Organisations should review every cloud service within scope and check that MFA is properly enabled for all relevant accounts.
# Clearer cloud service definitions
The 2026 requirements introduced a specific definition of what qualifies as a cloud service.
Under the current requirements, any online, scalable infrastructure used to host company data is considered in scope, including Microsoft 365, AWS, Azure and other SaaS platforms.
This clears up previous uncertainty and confirms that cloud services are now fully included in the assessment.
# Improved scoping and transparency
Organisations must explain any part of their infrastructure that is excluded from the assessment scope and justify how it is segregated from other networks.
This added clarity promotes transparency and ensures that each assessment accurately reflects an organisation's real-world risk.
# Passwordless authentication and passkeys take centre stage
The 2026 update identifies passwordless authentication, such as FIDO2 and passkeys, as the next step in identity security.
The National Cyber Security Centre (NCSC) encourages organisations to adopt these methods as their default to achieve stronger security and a smoother user experience.
This shift aligns with the wider industry movement towards phishing-resistant, user-friendly authentication.
# Backups and application development
The revised structure brings backup guidance to the forefront of the document, emphasising its importance in incident recovery.
The former web applications section has become application development, which aligns with the UK Government’s Software Security Code of Practice and promotes secure development standards.
# What businesses should do now
If your organisation is preparing for Cyber Essentials certification or renewal:
- Review MFA coverage across all services
- Audit cloud platforms and ensure none are excluded from the scope.
- Begin testing or implementing passwordless authentication.
- Refresh your backup strategy to meet best-practice standards.
## If in doubt, speak to your MSP or a certified Cyber Advisor, such as Grant McGregor.
Although Cyber Essentials remains a foundation of strong cyber hygiene, staying compliant means keeping pace with each evolution of the scheme.
If you’re planning your next certification or renewal, the official [Cyber Essentials Requirements for IT Infrastructure v3.3](https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf) is a good place to start. It explains the current requirements and helps you prepare for the assessment.
# How Grant McGregor can help
With a team of certified Cyber Essentials specialists, including a Cyber Advisor and Cyber Essentials Assessors, we help organisations understand the requirements and manage the certification process.
Whether you are applying for the first time or renewing, our team can assess your readiness, explain the requirements and help you prepare for the assessment.
# Call us: 0131 603 7910
Message us: [https://www.grantmcgregor.co.uk/contact-us](https://www.grantmcgregor.co.uk/contact-us)
[](https://cta-redirect.hubspot.com/cta/redirect/6138324/ee2a578f-e4c7-437c-bcdc-7f04f9d1e161)
Grant McGregor Team
5 November 2025 • 3 min read
## Recent Posts
### Shadow AI: Is Your Business Ready for AI Adoption?
Understand shadow AI's impact on your business. Discover how to assess risks, improve processes, and adopt AI securely w...
[Read More](https://blog.grantmcgregor.co.uk/shadow-ai-is-your-business-ready-for-ai-adoption)
### Our Net Zero Target for 2040: What Can We Change?
From company vehicles and travel to suppliers and technology, see how Grant McGregor is working towards its net zero tar...
[Read More](https://blog.grantmcgregor.co.uk/our-net-zero-target-for-2040-what-can-we-change)
### What Is Penetration Testing? A Guide for Businesses
Learn what penetration testing is, how it works, what the report should include and when your business should consider a...
[Read More](https://blog.grantmcgregor.co.uk/what-is-penetration-testing-a-guide-for-businesses)
### Grant McGregor Recognised as a Leading Global MSP in the 2026 MSP 501
Grant McGregor has been named a Top Global Managed Service Provider in the 2026 MSP 501, ranking #1 Scotland-based MSP a...
[Read More](https://blog.grantmcgregor.co.uk/grant-mcgregor-recognised-as-a-leading-global-msp-in-the-2026-msp-501)
Union
## Empower your business with secure, expert-led solutions.
Talk to us about people-focused technology that drives results.
[Start a conversation](https://grantmcgregor.co.uk/contact-us)
Premium IT Services Tailored for Leading Brands
[Follow us on LinkedIn](https://www.linkedin.com/company/grant-mcgregor-ltd/) [Follow us on Facebook](https://www.youtube.com/itgrantmcgregor) [Follow us on Facebook](https://www.facebook.com/grantmcgregorltd/) [Follow us on Twitter](https://x.com/GrantMcGregorIT)
Quick Links
- [Home](https://grantmcgregor.co.uk)
- [About us](https://grantmcgregor.co.uk/about-us/our-story)
- [Knowledge Hub](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
Services
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
Edinburgh – Chesterfield
[0131 603 7910](tel:+441316037910)
[info@grantmcgregor.co.uk](mailto:info@grantmcgregor.co.uk)
**Main Office:**
The Merchants' Hall,
22 Hanover St,
Edinburgh EH2 2EP
© 2026
Grant McGregor. All rights reserved.
[Privacy and Cookie Policy](https://blog.grantmcgregor.co.uk/hubfs/UsefulDownloads/Policies/GRMC-SEC-Privacy-and-Cookie-Policy.pdf)
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Grant McGregor Team",
"url" : "https://blog.grantmcgregor.co.uk/author/grmc-team"
},
"dateModified" : "2026-09-29T09:38:29.666Z",
"datePublished" : "2025-11-05T10:20:07.000Z",
"headline" : "Cyber Essentials 2026: MFA Rules, Cloud Scope & Compliance",
"image" : [ "https://blog.grantmcgregor.co.uk/hubfs/Cyber%20Essentials%202026.png" ],
"mainEntityOfPage" : {
"@id" : "https://blog.grantmcgregor.co.uk/cyber-essentials-2026",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.grantmcgregor.co.uk/hubfs/GRMC_blue_logo.svg"
},
"name" : "Grant McGregor"
}
}
```
```json
{
"@context" : "https://schema.org",
"@id" : "https://grantmcgregor.co.uk/",
"@type" : "LocalBusiness",
"address" : {
"@type" : "PostalAddress",
"addressCountry" : "GB",
"addressLocality" : "Edinburgh",
"postalCode" : "EH2 2EP",
"streetAddress" : "22 Hanover Street"
},
"geo" : {
"@type" : "GeoCoordinates",
"latitude" : 55.9526313,
"longitude" : -3.1970679
},
"image" : "https://grantmcgregor.co.uk/hubfs/GRMC_blue_logo.svg",
"name" : "Grant McGregor",
"openingHoursSpecification" : {
"@type" : "OpeningHoursSpecification",
"closes" : "18:00",
"dayOfWeek" : [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ],
"opens" : "08:00"
},
"sameAs" : [ "https://www.facebook.com/grantmcgregorltd/", "https://x.com/GrantMcGregorIT", "https://www.youtube.com/itgrantmcgregor", "https://www.linkedin.com/company/grant-mcgregor-ltd/" ],
"telephone" : "+441316037910",
"url" : "https://grantmcgregor.co.uk/"
}
```
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Grant McGregor team"
},
"dateModified" : "2026-09-29",
"datePublished" : "2025-11-05",
"headline" : "Cyber Essentials 2026: MFA Rules, Cloud Scope & Compliance",
"image" : {
"@type" : "ImageObject",
"height" : 1050,
"url" : "https://info.grantmcgregor.co.uk/hubfs/Cyber Essentials 2026.png",
"width" : 1800
},
"mainEntityOfPage" : {
"@id" : "https://blog.grantmcgregor.co.uk/cyber-essentials-2026",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://info.grantmcgregor.co.uk/hubfs/GM-logo-399.png"
},
"name" : "Grant McGregor"
},
"url" : "https://blog.grantmcgregor.co.uk/cyber-essentials-2026"
}
```