The Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026) defines the technical controls that organisations must implement to achieve certification.
This document sets out the five core technical control themes and clarifies how they apply across modern IT environments, including cloud services, BYOD, remote working, and third-party access.
It is the authoritative reference document underpinning the Cyber Essentials scheme.
What’s covered:
• The five technical control themes:
– Firewalls
– Secure Configuration
– Security Update Management
– User Access Control
– Malware Protection
- Definitive clarification that cloud services cannot be excluded from scope
- Mandatory MFA for cloud services (where available)
- Detailed passwordless authentication guidance (including FIDO2)
- 14-day vulnerability remediation requirement for high-risk updates
- Clear CVSS v3 alignment
- Administrative privilege separation requirements
- Application allow-listing and anti-malware expectations
- Sub-set scoping rules using firewall or VLAN separation
Key April 2026 clarifications
This version strengthens alignment with modern IT environments by:
- Formalising cloud service responsibility models (IaaS, PaaS, SaaS)
- Clarifying shared responsibility between organisations and providers
- Emphasising asset management as a core security function
- Reinforcing structured vulnerability management
- Removing ambiguity around remote working boundaries
Who should read this?
- IT Managers preparing for certification
- Security Leads responsible for vulnerability management
- MSPs supporting client certification
- Organisations planning Cyber Essentials Plus
This document is published by the National Cyber Security Centre (NCSC) and IASME under UK Crown Copyright. Secarma shares this to support organisations in understanding and implementing compliant controls.
