Cyber security standards in the UK are tightening because the way attacks happen has changed. Threat actors are increasingly using automation and artificial intelligence to exploit basic weaknesses more quickly and on a larger scale. In response, IASME and the National Cyber Security Centre are strengthening Cyber Essentials to close gaps that attackers routinely exploit.
On 14 April, Andrew Green, Andrew Beer, and Jordan Jenkins attended the IASME regional meeting for Certification Bodies (CBs) and Authorised Service Providers (ASPs). The session focused on upcoming changes to Cyber Essentials and Cyber Essentials Plus, the rationale behind them, and what businesses should prioritise as these changes come into effect.
Key takeaways
- MFA will be a requirement for all cloud accounts to pass Cyber Essentials and Cyber Essentials Plus
- Vulnerabilities must be patched within 14 days, or you risk failing both Cyber Essentials and Cyber Essentials Plus
- Liz Kendall has sent an open letter to all businesses to sure up cyber defences as a matter of urgency in the wake of growing threats from AI
- IASME are providing more tools to help businesses keep their supply chains secure
Why does this all matter?
IASME and the NCSC continue to warn that automated and AI-enabled attacks will accelerate the exploitation of the same basic weaknesses Cyber Essentials is designed to control. The NCSC AI Security Institute found that AI models could identify and exploit weak authentication, missing MFA, and unpatched systems to compromise a business in about half the time a human would.
Put simply, Cyber Essentials remains a strong baseline for preventing the most common attack paths, and the new requirements aim to close gaps that attackers routinely exploit.
An open letter from Liz Kendall MP to all businesses has stressed the importance of effective technical controls in protecting businesses in the wake of the growing AI threat and so cyber security should be a critical business objective for all organisations in the United Kingdom.
1) Key upcoming changes to Cyber Essentials / CE+
MFA will be mandatory for all cloud accounts where supported (no exceptions)
What this means:
Any account accessing a cloud service that supports MFA will be expected to have it enabled and enforced.
Scope (examples):
- Microsoft 365 / Google Workspace accounts
- Cloud admin portals (e.g., Azure, AWS, SaaS admin consoles)
- Third-party SaaS systems (e.g., HR/payroll, CRM, finance platforms)
- Remote access solutions and cloud-hosted management tools
Impact:
Missing MFA on any eligible cloud account may create non-compliance risk for CE / CE+.
Actions we’re taking (Security/IT):
- Confirm MFA enforcement across all cloud services in use
- Identify and remove/replace sign-in methods that bypass MFA where applicable (e.g., legacy access patterns)
2) Vulnerability remediation timelines tightening (CE+ – currently 14 days expected)
What this means:
For CE+, vulnerabilities identified during assessment will need to be remediated within 14 days, otherwise an organisation risks failing CE+. There are discussions that this window may reduce further in future.
Impact:
- Slower patching/updates increases risk of assessment failure
- Greater emphasis on timely remediation and evidence
Actions:
- Strengthen vulnerability handling
- Even if you don’t have Cyber Essentials, these vulnerabilities still affect you and should be a part of your cyber resilience
- Sign up to the NCSC early warning service
3) Supply Chain management
What this means:
IASME promoted the use of a supplier check tool that organisations can use to see if organisations in their supply chain have Cyber Essentials and Cyber Essentials Plus. It’s estimated 30% of breaches come from compromised third parties.
Actions:
Use this tool to identify suppliers who put security first and avoid the ones that don’t as they could end up helping a threat actor attack you.
What This Means in Practice
The upcoming changes to Cyber Essentials are not about making certification harder for the sake of it. They are about ensuring that the baseline standard reflects how attacks are happening today.
For organisations already meeting Cyber Essentials, this is a reminder that enforcement, consistency, and visibility across cloud services, patching processes, and suppliers are essential. For those that do not yet meet the standard, these changes outline the minimum expectations businesses should now be planning for.
Cyber security is no longer a once-a-year exercise. It is an ongoing responsibility, and Cyber Essentials is continuing to evolve to reflect that reality.
Looking to secure your business?
Excellence IT are an IASME Cyber Assurance Level 2 auditor and guides businesses daily to Cyber Essentials and Cyber Essentials Plus certification. If you’d like to speak to an expert, please contact marketing@excellence-it.co.uk or call 02920 887 362
As the Digital Marketing Lead at Excellence IT, I write content, create guides, and infographics on IT Support, Cyber Security, and Artificial Intelligence (AI) for SMEs.
