---
title: "Cyber Essentials 2026: MFA Rules, Cloud Scope & Compliance"
description: Stay updated with Cyber Essentials 2026's MFA rules, cloud service definitions and compliance strategies to enhance your organisation's cyber resilience.
---

[Grant McGregor Blog](https://blog.grantmcgregor.co.uk)

# [Cyber Essentials 2026: MFA Rules, Cloud Scope & Compliance](https://blog.grantmcgregor.co.uk/cyber-essentials-2026)

 Written by [Grant McGregor Team](https://blog.grantmcgregor.co.uk/author/grmc-team) | 05/11/2025, 10:20

Although IASME has described the 2026 update as "minor," it introduced important clarifications regarding multi-factor authentication (MFA), cloud services and scoping definitions. For many organisations, this means reviewing internal policies, raising awareness of user access controls and ensuring that MFA is properly enforced across every account.

 

As a government-backed scheme designed to protect against the most common cyber attacks, Cyber Essentials remains one of the simplest yet most effective frameworks for building cyber resilience.

 

The 2026 update reinforces the importance of getting the security fundamentals right and keeping them up to date as requirements evolve.

# MFA is now an automatic pass or fail

Multi-factor authentication has long been a Cyber Essentials requirement.

Under the 2026 requirements, MFA must be enabled for cloud services wherever it is available.

 

If it is available but has not been implemented, the organisation will automatically fail the assessment. No exceptions.

 

With credential-based attacks continuing to pose a threat, IASME emphasises MFA as an important additional layer of protection.

 

Organisations should review every cloud service within scope and check that MFA is properly enabled for all relevant accounts.

 

# Clearer cloud service definitions

The 2026 requirements introduced a specific definition of what qualifies as a cloud service.

 

Under the current requirements, any online, scalable infrastructure used to host company data is considered in scope, including Microsoft 365, AWS, Azure and other SaaS platforms.

 

This clears up previous uncertainty and confirms that cloud services are now fully included in the assessment.

 

# Improved scoping and transparency

Organisations must explain any part of their infrastructure that is excluded from the assessment scope and justify how it is segregated from other networks.

 

This added clarity promotes transparency and ensures that each assessment accurately reflects an organisation's real-world risk.

 

# Passwordless authentication and passkeys take centre stage

The 2026 update identifies passwordless authentication, such as FIDO2 and passkeys, as the next step in identity security.

 

The National Cyber Security Centre (NCSC) encourages organisations to adopt these methods as their default to achieve stronger security and a smoother user experience.

 

This shift aligns with the wider industry movement towards phishing-resistant, user-friendly authentication.

 

# Backups and application development

The revised structure brings backup guidance to the forefront of the document, emphasising its importance in incident recovery.

 

The former web applications section has become application development, which aligns with the UK Government’s Software Security Code of Practice and promotes secure development standards.

 

# What businesses should do now

If your organisation is preparing for Cyber Essentials certification or renewal:

 

- Review MFA coverage across all services
- Audit cloud platforms and ensure none are excluded from the scope.
- Begin testing or implementing passwordless authentication.
- Refresh your backup strategy to meet best-practice standards.

 

## If in doubt, speak to your MSP or a certified Cyber Advisor, such as Grant McGregor.

 

Although Cyber Essentials remains a foundation of strong cyber hygiene, staying compliant means keeping pace with each evolution of the scheme.

 

If you’re planning your next certification or renewal, the official [Cyber Essentials Requirements for IT Infrastructure v3.3](https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf) is a good place to start. It explains the current requirements and helps you prepare for the assessment.

 

# How Grant McGregor can help

With a team of certified Cyber Essentials specialists, including a Cyber Advisor and Cyber Essentials Assessors, we help organisations understand the requirements and manage the certification process.

 

Whether you are applying for the first time or renewing, our team can assess your readiness, explain the requirements and help you prepare for the assessment.

 

# Call us: 0131 603 7910

Message us: [https://www.grantmcgregor.co.uk/contact-us](https://www.grantmcgregor.co.uk/contact-us)

 

 

[View full post](https://blog.grantmcgregor.co.uk/cyber-essentials-2026)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Grant McGregor Team"
  },
  "dateModified" : "2026-09-29T09:38:29.673Z",
  "datePublished" : "2025-11-05T10:20:07Z",
  "headline" : "Cyber Essentials 2026: MFA Rules, Cloud Scope & Compliance",
  "image" : {
    "@type" : "ImageObject",
    "height" : 1050,
    "url" : "https://info.grantmcgregor.co.uk/hubfs/Cyber%20Essentials%202026.png",
    "width" : 1800
  },
  "mainEntityOfPage" : "https://blog.grantmcgregor.co.uk/cyber-essentials-2026",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Grant McGregor Blog"
  }
}
```