The Cyber Essentials rule that now fails you automatically

Cyber Essentials is the government-backed baseline for small business security: a self-assessment of the basics, checked by an accredited body. It's required for some government contracts, and some customers ask for it before they'll work with you.

In April 2026 the rules changed. IASME, which delivers the scheme on behalf of the National Cyber Security Centre, made one thing non-negotiable: multi-factor login has to be switched on for every cloud service you use, wherever the service offers it. If it's available — free, included in your plan, or a paid extra — and it isn't on, the assessment fails. Cloud services can't be left out of scope, either.

What makes that easy to miss is that a small business rarely runs one cloud service. Email, accounts, bookings, file storage, the website's admin login, the card terminal's dashboard — each is a separate login, and each one counts.

You can check this yourself. List every service your business logs into over the internet. For each one, open the security settings and see whether two-step login is offered, and whether it's switched on — for everyone with an account, not just you. Anything offered and not switched on is a fail today.

It's worth doing whether or not you ever apply. With it switched on, a stolen password on its own is no longer enough to get into your accounts.

If you'd rather have a hand, it's one of the things we do: we go through the whole Cyber Essentials checklist with you — email, passwords, devices, who can get at what — find where you'd fail today, and help you put it right. An accredited body does the certifying; we get you ready for it.