Cyber Essentials 2026: MFA is now mandatory

Cyber Essentials is the government-backed certificate a small business is most often asked for by an insurer, a council buying team or a larger customer it supplies. From April 2026 the scheme changed in one specific way: multi-factor authentication (MFA), a code from your phone as well as your password when you sign in, is now mandatory wherever it is technically available, and a missing second check is an automatic fail rather than a note on the report.

This is what that change means in practice, what the certificate costs, and when you can honestly skip it and simply do the work.

What is Cyber Essentials and does a small business need it?

Cyber Essentials is a UK scheme run under the National Cyber Security Centre. It is not a law and it is not an audit of everything you do. It is a self-assessment questionnaire covering five basic security controls, reviewed by an approved certification company, and it lasts twelve months. Cyber Essentials Plus is the same five controls with a hands-on technical check by an assessor rather than your own word for it.

The honest answer to who needs it is: the businesses somebody else is asking. In practice that means four groups.

• Anyone bidding for central government work where personal or sensitive information is handled. Certification has been a condition of those contracts for years.
• Suppliers to councils, NHS boards, universities and housing associations. Increasingly this arrives as a line in a tender document rather than a conversation.
• Businesses whose insurer asks. Cyber cover renewals now routinely ask about multi-factor authentication and security updates, and the answers affect the premium or the excess.
• Subcontractors to a larger private firm that has been certified itself and is pushing the requirement down its supply chain.

Some context for why this is landing on small firms now. The Cyber Security Breaches Survey 2025/26 found 43% of UK businesses reported a breach or attack in the previous twelve months, roughly 612,000 businesses, with 42% of micro businesses and 46% of small businesses affected. Only 15% of businesses review their suppliers' cyber risk at all. The ones that do are exactly the ones sending you a questionnaire.

Certification among small businesses is still low, but it is moving: 5% held Cyber Essentials a year ago, and 12% do now. That is the direction of travel, and it is why the requirement is turning up in places it did not a year ago.

What actually changed in April 2026

Multi-factor authentication became a hard requirement wherever it is technically available. If a service you use offers a second factor and it is switched off, the assessment fails. There is no partial credit and no "we will do it next quarter".

Multi-factor authentication means proving who you are twice: a password, plus a code from an app, a physical key, or at a minimum a code by text. It is the single most effective thing a small business can do about the most common kind of attack, because almost all of those attacks are somebody using a password they bought, guessed or tricked out of someone with a fake email rather than breaking anything.

The reason the scheme tightened this is in the same survey. Only 47% of UK businesses use any multi-factor authentication anywhere in the business. Slightly more than half have none, which is why a stolen password remains the most reliable way into a small firm in Britain.

What the MFA rule means for your website

This is the part that gets missed, because people think of the website as the thing on the internet and forget the four accounts that control it. All four need a second factor, and all four are technically capable of one.

The website's own admin login. Whatever you sign into in order to change a price or add a page. If it is WordPress, MFA is a plugin (an add-on that gives the site an extra feature) and twenty minutes. If it is a hosted platform, it is a setting.

The hosting account. Someone with this can replace the entire site, whatever the website login is protected with.

The domain registrar. The company you pay for your web address: the one people forget, and the worst one to lose. Whoever controls the web address controls the email addresses on it, and whoever controls the email can reset the password on nearly everything else you own. Check this one first.

The business email itself. Microsoft 365 and Google Workspace both support it properly. A mailbox with no second factor is a standing invitation to invoice fraud, which is the attack that actually costs small businesses money in this country.

Two practical notes. Prefer an authenticator app over a code by text where both are offered, because a criminal can talk your phone company into moving your number to their own SIM card and receive your texts. And a shared login that three people use is not proper access control, even with a second check on it. The assessment asks about named accounts, and so should you.

The five controls in plain English

Secure configuration. Devices and software set up deliberately rather than left as they came. Default passwords changed, accounts nobody uses removed, and services you are not using switched off. The router the broadband company posted you is the classic example.

Access control. Everyone has their own account, everyone has the least access their job needs, and administrator rights are not the setting your day-to-day login runs at. When somebody leaves, their access leaves with them the same week. This is where the new MFA requirement sits.

Software updates. Everything on a supported version and updated within fourteen days for anything critical. That covers phones and laptops as much as the website. Anything the maker no longer supports has to go, which is usually the awkward conversation in the room.

Malware protection. Antivirus, which catches harmful software such as viruses, on the machines that need it, kept updated. On modern Windows and macOS the built-in protection is acceptable. The control is that it exists and is switched on, not that you bought something.

Firewalls. A firewall, a filter that blocks unwanted traffic, between your work devices and the internet, set up properly, including on laptops that leave the building. The scheme reckons these five together prevent around 80% of the common attacks a small business will meet, which is a remarkable return for a fortnight of unglamorous work.

What it costs and how long it takes

The certificate itself is a few hundred pounds a year for a small business, with Cyber Essentials Plus meaningfully more because an assessor has to do the testing. Those are published figures that change, so check the current ones with a certification body rather than taking a number from an article.

The time is the honest part. The questionnaire is a day's work if your house is already in order. If it is not, the questionnaire is a very efficient way of finding that out, and the fixing is what takes the weeks. Do the five controls first and certify afterwards. Doing it in the other order means paying to be told what you already suspected.

When a one-person trade honestly does not need the certificate

If you are a sole trader, nobody has asked for it, you do not bid for public sector work and your insurer has not raised it, the certificate buys you nothing. It is a piece of evidence for somebody else's buying process. No buying process, no need for the evidence.

The controls are a different matter. Turn on multi-factor authentication for your email, your domain registrar, your hosting and your bank this week. Update your phone and laptop. Stop sharing one login. That is free, it takes an evening, and it is most of the actual protection. The certificate is the paperwork that proves it to somebody else.

The middle case is worth naming too: if you think a tender is coming in the next year, start the controls now and certify when the tender appears. Certification is fast when the work is done and slow when it is not.

If you want a straight look at the four website accounts above, that is part of the website security work here, and the consultation is free (opens in a new tab).