Has Cyber Essentials changed for 2026?

Yes. The Danzell question set replaced Montpellier on 27 April 2026. Headline changes: MFA on all cloud user accounts (not only admins), passkeys explicitly accepted, tightened cloud-service scope.

Are the requirements the same for CE and CE Plus?

Yes. The same five controls and same questions apply. CE Plus adds an independent technical audit to verify the controls are actually working.

Do the requirements apply to BYOD devices?

BYOD devices accessing in-scope cloud services bring those accounts into scope. The device itself does not need MDM, but MFA, password policy and patching expectations apply.

What is the 14-day patching rule?

Patches addressing high or critical severity vulnerabilities (CVSS v3 7.0+) must be applied within 14 days of vendor release. Lower severity patches are not strictly time-bound but should be managed.

Does Cyber Essentials require encryption?

Disk encryption is not explicitly required by the controls but is strongly recommended (and is implicit in mobile device security). For CE Plus, lack of disk encryption on mobile devices is increasingly flagged.

Cyber Essentials Requirements: 5 Controls & 2026 Updates

The five technical controls

1. Firewalls and routers

Every device with an internet connection must be protected by a correctly configured firewall. Default passwords on perimeter devices must be changed. Open inbound services must be documented and justified.

2. Secure configuration

Devices and software must be configured to reduce vulnerabilities: disable unused accounts and services, change default passwords, and apply hardening baselines (CIS, Microsoft baseline, etc.).

3. User access control

User accounts must be approved, used only for the privileges granted, and removed promptly when no longer needed. Administrator accounts must be separate from day-to-day user accounts. MFA is mandatory on all cloud accounts under the 2026 standard – see our MFA requirements guide.

4. Malware protection

Every in-scope device must be protected by anti-malware (signature-based, application allow-listing, or sandboxing). Windows Defender, Microsoft Defender for Endpoint, and reputable third-party AV all qualify when correctly configured.

5. Security update management

High and critical vulnerabilities must be patched within 14 days of release. Operating systems and applications must be supported (vendor-current). See our 14-day patching rule guide and unsupported software guide.

Evidence the assessor will want

MFA enforcement screenshots (Microsoft 365 Conditional Access, Google Workspace, etc.)
Firewall configuration export or screenshots
Patch status report (Intune, RMM tool, or screenshot)
List of administrator accounts and their justification
Anti-malware deployment evidence
List of cloud services in scope and account-level controls

2026 Danzell question set highlights

The Danzell update added explicit MFA-on-all-cloud-accounts, clarified BYOD scope, and brought passkeys into accepted MFA methods. See the full Danzell 2026 explainer.