A business that passed Cyber Essentials last year tends to treat its renewal as paperwork. The portal saves last year’s answers, and the systems appear identical.
The renewal assessment checks the business as it is on the day the certificate is issued, whatever last year’s answers said. Since April 2026, two ordinary lapses can fail that assessment outright, and twelve months is long enough for either to appear unnoticed. This article explains what changed, where those lapses come from and what to check before your Cyber Essentials renewal.
A Cyber Essentials pass only proves one day
Cyber Essentials is a UK government-backed scheme. IASME, which delivers it, now states that the point in time being assessed is the date the certificate is issued. The declaration signed by a director also includes an acknowledgement that the organisation must keep meeting the controls throughout the certification period.
A year is long enough for that to stop being true. A team adopts a new cloud tool, and a laptop spends weeks without restarting. Neither feels like a security event, so neither gets reviewed.
April 2026 made two ordinary lapses fatal
The NCSC requirements for version 3.3 keep the same five controls as before. They are firewalls, secure configuration, security update management, user access control and malware protection. The change this April is in the marking. Some requirements now carry automatic failure criteria, so missing one fails the whole assessment however well the organisation scores elsewhere.
The two that matter here are enabling multi-factor authentication on every cloud service where it is available and installing high-risk and critical updates within 14 days of release. The requirements already asked for both. What is new is that missing either now fails the whole assessment.
The Cyber Essentials 2026 rules apply to any assessment account created after 26 April 2026, which uses the Danzell version of the self-assessment. Organisations with an older active account had six months from that date to certify under the previous requirements, and that window has now closed. Every renewal from here is on Danzell.
The first lapse is a cloud account nobody in IT knows about
The Cyber Essentials MFA rule covers every cloud service the business uses, and it applies even when MFA is a paid option. A company can switch MFA on across Microsoft 365 and still fail because the finance team’s accounting platform was set up years ago with a password alone.
That account is easy to miss because software arrives one team at a time. Someone finds a tool, signs up with a work email address and starts using it. The NCSC definition of a cloud service includes exactly that, since it covers any service accessed with an email address used for business purposes that holds the organisation’s data. Version 3.3 also states that these services cannot be excluded from scope.
Using a reputable provider does not move the responsibility. For software as a service, the NCSC expects the provider to handle things like firewalls and security updates, while user access control stays with the customer every time. Who has an account and how they sign in is the business’s job.
The second lapse is an update that reached every device but one
The 14-day limit covers operating systems, router and firewall firmware and applications, including their extensions. The NCSC counts an update as high-risk or critical when the vendor labels it that way, when it fixes a vulnerability scoring 7 or above on the CVSS v3 scale, or when the vendor gives no severity details at all. A firewall left on old firmware three weeks after a critical fix was released is enough to fail the assessment.
Automatic updates do not prevent this, because they rely on a device staying connected long enough to finish. A laptop used mostly at home can miss its window, and firewall firmware often needs someone to install it. Vendors also bundle fixes, so a routine monthly update containing one high-risk fix starts the 14-day clock for everything in it.
Passing depends on a routine that installs updates and then checks they landed on every device in scope. That is ordinary proactive IT support work.
So check before you apply, not after
Both lapses are simpler to fix before submission than to explain afterwards. Work through these six checks.
- List every cloud service in use, including tools departments chose for themselves.
- Confirm MFA is on in each one where it is available, paid options included.
- Check that high-risk and critical updates are installed within 14 days of release.
- Apply that check to laptops, desktops, applications, routers and firewalls.
- Confirm the scope matches the IT environment you run today.
- Download the Danzell version of the self-assessment and answer it fresh, because last year’s answers may no longer be enough.
The five controls have not changed, but a single cloud account without MFA or an overdue critical update now ends the assessment on its own. The checking belongs before you apply, before anything is final. Datek’s project team can run that pre-check with you, and our free cybersecurity guide covers the wider risks worth reviewing while you are at it.
The updated requirements could reveal gaps you haven’t considered. Datek’s project team can review your current setup, identify what needs attention and help you prepare with confidence. Contact Datek today to get started.
