Cyber Essentials Scheme Updates: What Has Changed and What UK Organisations Need to Do

GRC Solutions has published a detailed overview of the latest updates to the UK's Cyber Essentials scheme, covering the changes introduced and their practical implications for organisations seeking or renewing certification. Cyber Essentials is the NCSC-backed government scheme that sets a baseline of technical controls organisations are expected to have in place to protect against common cyber threats. The updated requirements reflect changes in how organisations now operate, with revisions covering cloud services, home working environments, multi-factor authentication requirements, and the scope of devices that must be included within an assessment.

Why this matters for UK organisations

Cyber Essentials certification has become an increasingly important commercial and contractual requirement across the UK. It is mandatory for organisations bidding for central government contracts that involve handling personal data or providing certain technical services, and it is widely required across the Ministry of Defence supply chain. A growing number of private sector clients also use it as a baseline assurance measure when evaluating suppliers and partners. The scheme updates mean that organisations approaching renewal or first-time certification cannot assume that controls which previously met the standard will continue to do so. Areas including MFA coverage, the treatment of cloud-hosted services, and the scope of bring-your-own-device policies have all seen meaningful changes that could affect how organisations prepare for and pass assessment.

What to review

Organisations holding or planning to obtain Cyber Essentials certification should review the updated requirements against their current controls before their next assessment window. IT and security teams should pay particular attention to MFA requirements, which have been extended in scope, and to how cloud services are now treated within the assessment boundary. Device management policies, particularly where staff use personal devices for work, should also be reviewed against the revised standard. Organisations in government or defence supply chains should check whether their contracts specify a particular version of the scheme or an updated compliance deadline. For those who have not yet begun the process, starting with a gap analysis against the current requirements is a practical first step.

Source: GRC Solutions