The “Danzell” Shift: Getting Your Business Ready for the Cyber Essentials 2026 Update
If you’ve been through the certification process before, you know it’s usually a straightforward way to prove your business takes security seriously. However, the Cyber Essentials 2026 update is moving the goalposts. Officially known as Version 3.3 (or “Danzell”), these changes arriving on April 27 are much firmer than we’ve seen in previous years.
Why the Cyber Essentials 2026 Update is Necessary
To put it simply: the way we work has outpaced the old rules. We aren’t just sitting behind office firewalls anymore; we’re in the cloud and on our phones. This update finally closes the “ambiguity gaps” that used to let some businesses slide by. For more details on global cybersecurity shifts, you can check the latest NCSC security guidelines.
Mandatory MFA in the Cyber Essentials 2026 Update
The biggest headline of this update is Multi-Factor Authentication (MFA). In the past, you might have only protected your admin accounts. From April 27, if a cloud service supports MFA, you must have it turned on for every single user. If one person in your team isn’t using MFA on a cloud-based tool, your assessment will be an automatic fail.
Cloud Services: No Longer “Out of Sight”
Another major shift in the Cyber Essentials 2026 update is how we define “Scope.” Previously, there was confusion about which cloud services needed to be included. The new rules make it clear: if it stores your business data, it’s in scope. This aligns with our recent guide on Shadow AI Insider Threat: The New Quiet Risk to Your Network.
What Should You Do Right Now?
If your certification is due soon, don’t wait.
The 14-Day Rule: Be ready to patch “Critical” vulnerabilities within 14 days.
Audit your logins: Ensure every cloud app has MFA enabled.
Last modified: April 10, 2026
