Telappliant
Cyber Security Guide · 22 May 2026

Cyber Essentials Plus: what changed in 2026

The latest control changes, common audit failures and how to prepare in six weeks.

By the Telappliant team

Cyber EssentialsComplianceCertification
Cyber Essentials Plus certification badge over a secure UK workplace

Cyber Essentials Plus keeps evolving as the threat landscape shifts. The 2026 update tightens several controls that trip up organisations who scraped through last year.

What changed

  • Stricter scope rules for home-working and BYOD devices
  • MFA required on all cloud services, not just admin accounts
  • Software update SLAs shortened for high-severity vulnerabilities
  • Clearer expectations around passwordless and phishing-resistant MFA

Common audit failures

  • Unmanaged personal devices accessing corporate email
  • Unsupported operating systems still in production
  • Missed patches on browsers, Office and third-party apps
  • MFA exceptions for shared or service accounts

A six-week readiness plan

  • Week 1: scope confirmation and asset inventory
  • Weeks 2-3: MFA everywhere, remove unsupported software
  • Weeks 4-5: patch backlog, secure configuration baselines
  • Week 6: gap review, then book the audit

Next steps

Frequently asked questions

Was this article helpful?

Further reading

Related guides

More practical guidance from the Telappliant team on the same topic.

An IT manager auditing network hardware against a Cyber Essentials checklist
Cyber Security Guide

Cyber Essentials: why UK businesses treat it as a must-have

The five controls, what certification proves, where it stops, and how long it realistically takes.

Read
A school IT technician checking network equipment in a school comms room
Cyber Security Guide

Cyber Essentials for schools and academy trusts

What the five controls mean in a school environment, how they line up with DfE digital standards, and a realistic route to certification.

Read
Stack of unsupported end-of-life network hardware awaiting replacement
Cyber Security Guide

End-of-life devices and the risk to your Cyber Essentials certification

Unsupported operating systems, firmware and network kit are the most common reason UK businesses fail assessment. Here is how to stay ahead of it.

Read

Talk to a technology partner

Get direct access to the people who manage, support and improve your technology. Our teams work together across our locations, so whether the issue is IT, communications, connectivity or security, we can bring in the right expertise without passing you between separate providers.

  • One integrated support team
  • Expertise across IT, communications, connectivity and security
  • Connected support across our locations
Contact usReview my technology
Technology team reviewing plans together before a consultation
Call us Book consultation