---
title: Nine months on… meeting the new Cyber Essentials requirements
description: In January, the Cyber Essentials scheme underwent an update. Now, we consider what have we learnt and how your organisation can meet the new requirements.
image: https://blog.grantmcgregor.co.uk/hubfs/CE-1.png
---
[](https://www.grantmcgregor.co.uk/)
- [Home](https://grantmcgregor.co.uk/)
- About Us
- [Our Story](https://grantmcgregor.co.uk/about-us/our-story)
- [Meet the Team](https://grantmcgregor.co.uk/about-us/meet-the-team)
- [Certifications](https://grantmcgregor.co.uk/about-us/certifications)
- [Careers](https://grantmcgregor.co.uk/about-us/careers)
- IT Support Services
- [IT Support Services](https://grantmcgregor.co.uk/it-support-services)
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- Professional IT Services
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Microsoft 365](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-business-premium)
- [Microsoft Copilot](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-copilot)
- [AI Adoption Services](https://grantmcgregor.co.uk/ai-adoption-services)
- [Microsoft Azure](https://grantmcgregor.co.uk/professional-it-services/microsoft-azure)
- [MDR](https://blog.grantmcgregor.co.uk/mdr-vs-soc-cyber-security-defence)
- [Microsoft Teams Phone](https://grantmcgregor.co.uk/professional-it-services/microsoft-teams-phone)
- [KnowBe4](https://grantmcgregor.co.uk/professional-it-services/knowbe4)
- [DMARC](https://grantmcgregor.co.uk/professional-it-services/dmarc)
- [Enclave Networks](https://grantmcgregor.co.uk/professional-it-services/enclave-networks)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
- Knowledge Hub
- [Case Studies](https://grantmcgregor.co.uk/knowledge-hub/case-studies)
- [Testimonials](https://grantmcgregor.co.uk/knowledge-hub/success-stories)
- [Blog](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Podcast](https://grantmcgregor.co.uk/knowledge-hub/podcast)
- [Client Area](https://grantmcgregor.co.uk/client-area)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
- [Home](https://grantmcgregor.co.uk/)
- About Us
- [Our Story](https://grantmcgregor.co.uk/about-us/our-story)
- [Meet the Team](https://grantmcgregor.co.uk/about-us/meet-the-team)
- [Certifications](https://grantmcgregor.co.uk/about-us/certifications)
- [Careers](https://grantmcgregor.co.uk/about-us/careers)
- IT Support Services
- [IT Support Services](https://grantmcgregor.co.uk/it-support-services)
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- Professional IT Services
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Microsoft 365](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-business-premium)
- [Microsoft Copilot](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-copilot)
- [AI Adoption Services](https://grantmcgregor.co.uk/ai-adoption-services)
- [Microsoft Azure](https://grantmcgregor.co.uk/professional-it-services/microsoft-azure)
- [MDR](https://blog.grantmcgregor.co.uk/mdr-vs-soc-cyber-security-defence)
- [Microsoft Teams Phone](https://grantmcgregor.co.uk/professional-it-services/microsoft-teams-phone)
- [KnowBe4](https://grantmcgregor.co.uk/professional-it-services/knowbe4)
- [DMARC](https://grantmcgregor.co.uk/professional-it-services/dmarc)
- [Enclave Networks](https://grantmcgregor.co.uk/professional-it-services/enclave-networks)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
- Knowledge Hub
- [Case Studies](https://grantmcgregor.co.uk/knowledge-hub/case-studies)
- [Testimonials](https://grantmcgregor.co.uk/knowledge-hub/success-stories)
- [Blog](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Podcast](https://grantmcgregor.co.uk/knowledge-hub/podcast)
- [Client Area](https://grantmcgregor.co.uk/client-area)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
[Contact Us](https://grantmcgregor.co.uk/contact-us)
[Back to main](https://grantmcgregor.co.uk/knowledge-hub/blog)
Cyber Security
# Nine months on… meeting the new Cyber Essentials requirements
Grant McGregor Team
20 September 2022 • 5 min read
## Early this year, the Cyber Essentials scheme underwent its biggest shake-up since its launch. Now, nine months on, the Grant McGregor team considers what we’ve learnt and offers some advice about how your organisation can meet the new requirements.
In November 2021, the two organisations with responsibility for running the UK Government’s Cyber Essentials scheme announced that the requirements for organisations seeking certification would be changing. The changes came into effect from January 24, 2022.
### What is Cyber Essentials?
For those of you unfamiliar with [Cyber Essentials](https://www.grantmcgregor.co.uk/cyber-security/safer-business), it’s a government-backed scheme designed to help small and mid-size businesses around the UK to strengthen their cyber-security. It was originally launched in response to the number of small and mid-size businesses that were failing to implement even basic cyber security controls.
The scheme has been a great success since its launch. It has helped more than 30,000 UK organisations to strengthen and evidence their cyber security practices. However, technology has changed greatly in the eight years since the scheme was launched. To bring Cyber Essentials up to date with current risks and ways of working, the January 2022 changes were implemented.
### How has the scheme changed?
You can find out the full details about how the Cyber Essentials scheme has changed in our [earlier blog about the changes](https://blog.grantmcgregor.co.uk/cyber-essentials-has-changed.-heres-how).
Essentially, the two major areas of change are:
• Multi-factor authentication
• End-user devices (and, especially, the correct implementation of firewall controls)
There is also additional guidance about the need for backup and recovery to mitigate the growing ransomware threat. This isn’t essential – but very advisable! Let’s look at how small and mid-size businesses can address these changes to the scheme and, in doing so, strengthen their cyber-security posture.
### Multi-factor authentication
The Cyber Essentials changes brings the scheme in line with guidance from the UK’s National Cyber Security Centre (NCSC) around [passwords and user authentication](https://blog.grantmcgregor.co.uk/the-new-password-rules-2022-update).
Ideally, you should implement [multi-factor authentication](https://blog.grantmcgregor.co.uk/how-to-implement-multi-factor-authentication) in conjunction with a password of at least 8 characters, with no maximum length restrictions. Further, to unlock a locked device, biometrics or a password or pin length of 6 characters are required.
In addition, to protect against brute-force password-guessing attacks, at least one of the following should be implemented: [multi-factor authentication](https://www.grantmcgregor.co.uk/cyber-security/safer-data-and-access); throttling the rate of unsuccessful or guessed attempts; locking accounts after no more than 10 unsuccessful attempts. We’d suggest implementing all three would be a good idea.
The security tools that come as standard within a Microsoft 365 Business Plus subscription provide many of the essential tools here. This includes being able to ensure secure remote access by configuring policies to strengthen your security, e.g. disable access from untrusted locations; only allow access from registered devices; enforce multi-factor authentication.
The [Microsoft Authenticator App](https://blog.grantmcgregor.co.uk/a-guide-to-making-hybrid-work-over-the-long-term) used in conjunction with Active Directory will help you to meet most requirements.
### Managing end-user devices
The effective management of end-user devices requires a carrot-and-stick approach.
Standardising on a high-quality but affordable device that staff want to use is a good way to encourage compliance and reduce the use of unauthorised devices for work. The [Microsoft Surface family of devices](https://blog.grantmcgregor.co.uk/should-your-organisation-standardise-on-microsoft-surface-devices) stands out here because of its tight integration with Microsoft tools like Autopilot and Intune.
If a nice device is the carrot, these tools are the stick. They enable you to create and enforce policies that prevent data leakage and secure all end devices, including Windows, IoS and Android.
This includes being able to ensure secure remote access by configuring policies to strengthen your security, e.g. disable access from untrusted locations; only allow access from registered devices; enforce multi-factor authentication. It also enables you to [remotely wipe devices](https://blog.grantmcgregor.co.uk/2018/what-not-to-do-when-you-lose-your-mobile-device) if they are lost or stolen.
The auto-provisioning that Autopilot enables also helps you to [implement effective policies around the management of end devices for leavers and starters](https://blog.grantmcgregor.co.uk/your-guide-to-creating-an-effective-enrolment-policy-for-users-and-devices).
### Backup and recovery
While the new additions to the Cyber Essentials scheme around backup and recovery are only guidance at the moment, we would advocate that you follow them. [Effective backup and recovery](https://www.grantmcgregor.co.uk/cloud-services-and-it-solutions/data-backup-disaster-recovery-services) are the only way to truly be sure your organisation can recover from a ransomware attack.
Developing a backup and recovery solution begins with analysing the desirable recovery point objectives and desirable recovery time objectives with leaders and users across the business. Once these have been defined, you will have a clear idea of [what your backup solution must be able to do](https://blog.grantmcgregor.co.uk/refreshing-your-bcdr-plans-is-now-the-time).
One often-overlooked element of backup and recovery is the backup of your Microsoft 365 deployment. Here, my team would recommend the use of a specialist cloud backup solution. This enables you to back up your Microsoft 365 data effortlessly including email items (emails, contacts & calendars), SharePoint, Teams and data from other cloud service providers too.
For a more tailored backup solution, please get in touch to arrange a consultation with our team.
### What next?
For assistance with your Cyber Essentials preparation or certification – or for wider practical, unbiased security advice from technology experts – the Grant McGregor team is always on hand to help.
Call us: 0808 164 4142
Message us: www.grantmcgregor.co.uk/contact-us
About Cyber Essentials
Download our updated Cyber Essentials guide here:
[](https://cta-redirect.hubspot.com/cta/redirect/6138324/1cd56522-8af9-4ed3-b1bc-22e7a80f1d5e)
Further information on cyber-security topics
Read some of our other recent articles about cyber-security topics on our blog:
• [How to protect your organisation against 2022 phishing threats](https://blog.grantmcgregor.co.uk/how-to-protect-your-organisation-against-2022-phishing-threats)
• [How to implement multi-factor authentication](https://blog.grantmcgregor.co.uk/how-to-implement-multi-factor-authentication)
• [Essential security tips following the war in Ukraine](https://blog.grantmcgregor.co.uk/what-does-the-war-in-ukraine-mean-for-your-cyber-security)
• [Overview of the changes to the Cyber Essentials scheme](https://blog.grantmcgregor.co.uk/cyber-essentials-has-changed.-heres-how)
• [China: the new security risk?](https://blog.grantmcgregor.co.uk/china-the-new-security-risk)
• [Your 2022 update on the ransomware threat](https://blog.grantmcgregor.co.uk/your-2022-update-on-the-ransomware-threat)
Grant McGregor Team
20 September 2022 • 5 min read
## Recent Posts
### Shadow AI: Is Your Business Ready for AI Adoption?
Understand shadow AI's impact on your business. Discover how to assess risks, improve processes, and adopt AI securely w...
[Read More](https://blog.grantmcgregor.co.uk/shadow-ai-is-your-business-ready-for-ai-adoption)
### Our Net Zero Target for 2040: What Can We Change?
From company vehicles and travel to suppliers and technology, see how Grant McGregor is working towards its net zero tar...
[Read More](https://blog.grantmcgregor.co.uk/our-net-zero-target-for-2040-what-can-we-change)
### What Is Penetration Testing? A Guide for Businesses
Learn what penetration testing is, how it works, what the report should include and when your business should consider a...
[Read More](https://blog.grantmcgregor.co.uk/what-is-penetration-testing-a-guide-for-businesses)
### Grant McGregor Recognised as a Leading Global MSP in the 2026 MSP 501
Grant McGregor has been named a Top Global Managed Service Provider in the 2026 MSP 501, ranking #1 Scotland-based MSP a...
[Read More](https://blog.grantmcgregor.co.uk/grant-mcgregor-recognised-as-a-leading-global-msp-in-the-2026-msp-501)
Union
## Empower your business with secure, expert-led solutions.
Talk to us about people-focused technology that drives results.
[Start a conversation](https://grantmcgregor.co.uk/contact-us)
Premium IT Services Tailored for Leading Brands
[Follow us on LinkedIn](https://www.linkedin.com/company/grant-mcgregor-ltd/) [Follow us on Facebook](https://www.youtube.com/itgrantmcgregor) [Follow us on Facebook](https://www.facebook.com/grantmcgregorltd/) [Follow us on Twitter](https://x.com/GrantMcGregorIT)
Quick Links
- [Home](https://grantmcgregor.co.uk)
- [About us](https://grantmcgregor.co.uk/about-us/our-story)
- [Knowledge Hub](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
Services
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
Edinburgh – Chesterfield
[0131 603 7910](tel:+441316037910)
[info@grantmcgregor.co.uk](mailto:info@grantmcgregor.co.uk)
**Main Office:**
The Merchants' Hall,
22 Hanover St,
Edinburgh EH2 2EP
© 2026
Grant McGregor. All rights reserved.
[Privacy and Cookie Policy](https://blog.grantmcgregor.co.uk/hubfs/UsefulDownloads/Policies/GRMC-SEC-Privacy-and-Cookie-Policy.pdf)
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Grant McGregor Team",
"url" : "https://blog.grantmcgregor.co.uk/author/grmc-team"
},
"dateModified" : "2022-11-07T14:59:22.535Z",
"datePublished" : "2022-09-20T08:30:00.000Z",
"headline" : "Nine months on… meeting the new Cyber Essentials requirements",
"image" : [ "https://blog.grantmcgregor.co.uk/hubfs/CE-1.png" ],
"mainEntityOfPage" : {
"@id" : "https://blog.grantmcgregor.co.uk/nine-months-on-meeting-the-new-cyber-essentials-requirements",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.grantmcgregor.co.uk/hubfs/GRMC_blue_logo.svg"
},
"name" : "Grant McGregor"
}
}
```
```json
{
"@context" : "https://schema.org",
"@id" : "https://grantmcgregor.co.uk/",
"@type" : "LocalBusiness",
"address" : {
"@type" : "PostalAddress",
"addressCountry" : "GB",
"addressLocality" : "Edinburgh",
"postalCode" : "EH2 2EP",
"streetAddress" : "22 Hanover Street"
},
"geo" : {
"@type" : "GeoCoordinates",
"latitude" : 55.9526313,
"longitude" : -3.1970679
},
"image" : "https://grantmcgregor.co.uk/hubfs/GRMC_blue_logo.svg",
"name" : "Grant McGregor",
"openingHoursSpecification" : {
"@type" : "OpeningHoursSpecification",
"closes" : "18:00",
"dayOfWeek" : [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ],
"opens" : "08:00"
},
"sameAs" : [ "https://www.facebook.com/grantmcgregorltd/", "https://x.com/GrantMcGregorIT", "https://www.youtube.com/itgrantmcgregor", "https://www.linkedin.com/company/grant-mcgregor-ltd/" ],
"telephone" : "+441316037910",
"url" : "https://grantmcgregor.co.uk/"
}
```