Cyber Essentials MFA Compliance: Requirements, Implementation & Best Practices

Cyber Essentials MFA Requirements at a Glance

• MFA on cloud services is mandatory: The User Access Control theme requires MFA wherever it is available, and states that authentication to cloud services must always use it.
• Missing MFA is an automatic failure: Under the marking criteria introduced in April 2026, an organization that has not enabled MFA on an in-scope cloud service fails the assessment outright, whether that MFA is free, bundled, or a paid add-on.
• Cloud services cannot be taken out of scope: v3.3 states that if your organizational data or services are hosted on cloud services, those services are in scope, so the MFA requirement follows them.
• MFA also gates internet-facing firewall administration: Under the Firewalls theme, an administrative interface reachable from the internet needs MFA or a tightly managed IP allow list, and only with a documented business need.
• MFA changes your password obligations: With MFA, the password element must be at least 8 characters with no maximum length. Without it, you need a 12-character minimum, or 8 characters plus automatic blocking of common passwords.
• FIDO2 and passkeys count, SMS is discouraged: v3.3 confirms FIDO2 authenticators are regarded as MFA. The NCSC accepts SMS as better than nothing but recommends stronger alternatives where available.

What is Cyber Essentials?

Cyber Essentials is a UK government-backed cyber security certification scheme, launched in June 2014 as part of the UK’s National Cyber Security Strategy. It is owned by the National Cyber Security Centre (NCSC) and delivered by the IASME Consortium, which became the sole Cyber Essentials Delivery Partner in April 2020, replacing an earlier five-partner model. IASME licenses a network of more than 400 UK certification bodies and assessors.

The scheme is built around five technical controls: firewalls, secure configuration, security update management, user access control, and malware protection. The standard itself is the Requirements for IT Infrastructure document, reviewed annually by the NCSC and IASME. The current edition is v3.3, published in April 2026 and assessed through a question set named Danzell, and it applies to all assessment accounts created after 26 April 2026. Accounts opened before that date continue under v3.2 and the Willow question set from April 2025.

Cyber Essentials is a certification scheme rather than a law, so no regulator can fine an organization for not holding it. In practice it behaves as mandatory across a large slice of the UK economy, because central government, the NHS, the Ministry of Defence, and a growing list of private buyers require it in contracts. There are two levels: Cyber Essentials, a verified self-assessment signed off by a board member and marked by a qualified assessor, and Cyber Essentials Plus, which covers the same requirements and adds hands-on technical testing. Certification starts at £320 plus VAT, lasts 12 months, and brings cyber liability insurance arranged by IASME for UK organizations under £20 million turnover that certify their whole organization.

Who Does Cyber Essentials Apply To?

Cyber Essentials is open to organizations of any size and sector, and the NCSC positions it as the minimum standard it recommends to every organization. The groups below are the ones for whom it is effectively compulsory.

• Central government suppliers: Procurement Policy Note 014, in force since 24 February 2025, requires Cyber Essentials or Cyber Essentials Plus certification (or demonstrated equivalent controls) for contracts involving citizens’ personal data, government staff personal data, or ICT systems at the OFFICIAL classification. It replaced PPN 09/23 and the original PPN 09/14 requirement that has applied since 2014.
• Defence suppliers: MOD contracts routinely require Cyber Essentials, and IASME also delivers the Defence Cyber Certification scheme, which builds on the same baseline.
• NHS and health and social care suppliers: Many NHS procurements require Cyber Essentials or Cyber Essentials Plus alongside the Data Security and Protection Toolkit, particularly where patient data is involved.
• Devolved and local public sector suppliers: Welsh Procurement Policy Note 08/21 mirrors the UK government position, and certification is widely expected across the Scottish public sector and by local authorities buying IT services.
• Sub-contractors and supply chain participants: The requirement cascades, so sub-contractors handling the same data as a certified prime contractor are commonly required to certify too.

A note for Canadian and other non-UK organizations: Cyber Essentials is not limited to UK-registered entities. Any organization can certify provided the assessment is carried out by a UK-based certification body, and overseas applicants are allocated one on application. This matters for Canadian firms bidding for UK public sector work and for Canadian groups certifying a UK subsidiary. Only the bundled cyber liability insurance is UK-restricted.

What Are the Cyber Essentials Requirements?

The five technical control themes in Requirements for IT Infrastructure v3.3 apply to everything inside your declared scope, which must cover the whole IT infrastructure used to run your business or a clearly defined, separately managed sub-set. End user devices can never be excluded, and neither can cloud services. Three of the five themes carry authentication obligations, mapped below.

User Access Control: The MFA Requirement

User Access Control carries the MFA obligation. It requires organizations to control account creation and approval, authenticate users with unique credentials, remove accounts no longer needed, keep administrative activity on separate accounts, and implement MFA where available. On cloud services the wording leaves no discretion: authentication to cloud services must always use MFA.

The requirement extends to accounts your organization owns but a third party uses. If a managed service provider or contractor administers your environment through an account you own, that account is in scope and needs MFA. One exclusion works in your favour: a mobile device used only for voice, text, and MFA applications is out of scope, so issuing a phone purely as an authenticator does not pull it into the assessment.

How MFA Changes Your Password Requirements

The password rules in v3.3 give you a choice, and MFA is the easiest way through it. Passwords must be protected against brute-force guessing by one of three measures: MFA, throttling so that no more than 10 guesses are possible in 5 minutes, or locking after no more than 10 failed attempts. Password quality must be managed by one of three measures as well: MFA, a 12-character minimum, or an 8-character minimum combined with automatic blocking of common passwords from a deny list.

Where MFA is in place, the password element must be at least 8 characters with no maximum length restriction. Deploying MFA therefore satisfies two requirements at once and lets you retire the periodic expiry and complexity rules the NCSC now advises against.

Firewall and Network Device Administration

The Firewalls theme adds one more mandatory use for MFA. An interface used to manage firewall configuration must not be reachable from the internet unless there is a clear and documented business need and the interface is protected either by MFA or by an IP allow list restricted to a small range of trusted addresses. MFA is usually the cleaner option, because an allow list has to be maintained and justified at every renewal.

What Acceptable MFA Looks Like

v3.3 defines MFA as authentication using two or more verification factors, and lists four additional factor types to consider alongside a password: a managed or enterprise device, an app on a trusted device, a physically separate token, and a known or trusted account. The update also strengthened the passwordless guidance, confirming that FIDO2 authenticators count as passkeys and are regarded as MFA in their own right. Biometrics, security keys, smart cards, push notifications, and one-time codes are all recognized methods. On SMS, the NCSC is explicit that it is not the most secure option but is a large improvement over nothing, and recommends alternatives where they will work for your users.

Is MFA Required by Cyber Essentials?

Yes. MFA is mandatory under the User Access Control theme, and since April 2026 it is the hardest requirement in the scheme to fail quietly. MFA must be implemented wherever it is available, and authentication to cloud services must always use it. An organization that cannot demonstrate MFA on its in-scope cloud services will not certify.

What changed in April 2026 is the marking rather than the requirement. IASME and the NCSC introduced stricter criteria for questions covering critical practices, and MFA on cloud services is now an auto-fail question: failing it fails the whole assessment, however well the other answers score. IASME was direct about the reason organizations most often give, stating that it does not matter whether MFA on a service is free, included in your licence, or a paid option. Two security update management questions, A6.4 and A6.5, covering 14-day installation of high-risk and critical fixes, became auto-fail at the same time.

The wording is firmest on cloud services, but the requirement does not stop there. MFA is required wherever it is available across your scope, expected on administrative accounts and accounts reachable from the internet, and offered as the primary control for internet-facing firewall administration. Because v3.3 also states that cloud services cannot be excluded from scope, narrowing a scope to avoid a difficult service no longer works.

The bottom line is that MFA is now a pass-or-fail control. Inventory every cloud service, confirm MFA is enabled on every account including administrative and third-party accounts, and extend it to the remote access and administrative systems you run yourself.

Consequences of Cyber Essentials Non-Compliance

Cyber Essentials carries no regulatory fines, because it is a certification scheme rather than legislation. The consequences are commercial, and where a security failure leads to a personal data breach, regulatory through a different route.

The UK enforcement record shows what the last row looks like in practice. In March 2025 the Information Commissioner’s Office fined Advanced Computer Software Group £3,076,320 following an August 2022 LockBit ransomware attack on its health and care subsidiary, which disrupted NHS 111, out-of-hours services, and ambulance dispatch and exposed the personal data of 79,404 people. The ICO found that attackers gained entry through a customer account without MFA enabled, and cited gaps in applying MFA across the organization alongside insufficient vulnerability scanning and patch management. The fine was reduced from a provisional £6.09 million in recognition of the company’s cooperation with the NCSC, the National Crime Agency, and the NHS, and Information Commissioner John Edwards used the decision to urge every organization to secure all external connections with MFA.

Advanced had MFA across much of its estate. One account without it was enough, which is the risk the Cyber Essentials auto-fail rule exists to catch before an attacker does.

How to Implement MFA for Cyber Essentials Compliance

1. Define Your Scope and Inventory Every Cloud Service

Scope drives everything else, so settle it first. Your assessment must cover the whole IT infrastructure used to run your business, or a sub-set separated by a firewall or VLAN that you can justify to your assessor. End user devices cannot be excluded, and neither can cloud services. Inventory every service that stores or processes organizational data and is accessed through an account, including the ones bought outside IT, since shadow SaaS found late is a common cause of failure. v3.3 also requires you to describe excluded areas and list every legal entity in scope.

2. Check MFA Availability on Every Service and Account

For each service, confirm whether MFA is available and switched on for every account, not just the obvious ones. Work through administrative accounts, service and break-glass accounts, accounts used by managed service providers and contractors, and accounts belonging to staff who joined before the rollout. Because paid MFA still counts as available, licence cost is not a defence: find anywhere MFA sits behind an upgrade and budget for it before you register.

3. Choose a Solution That Covers Your Own Infrastructure Too

Cloud MFA built into Microsoft 365 or Google Workspace handles the cloud half of the requirement, but the scheme asks for MFA wherever it is available across the whole scope. Most UK organizations still run VPN concentrators, Remote Desktop gateways, firewall management interfaces, Windows servers, and line of business applications a cloud identity provider does not reach. Look for RADIUS, LDAP, and Active Directory support so one policy covers both sides, and decide whether you need cloud, on-premises, or hybrid deployment given your data residency and network constraints.

4. Enforce MFA on Administrative and Internet-Facing Access First

Sequence the rollout by risk. Administrative accounts, remote access, and any management interface reachable from the internet come first, because these are where an assessor looks and where attackers start. If a firewall or router administrative interface must be internet-facing, put MFA in front of it and document the business need rather than relying on an allow list you have to justify at every renewal.

5. Prefer Phishing-Resistant Factors, Then Simplify Passwords

Any MFA beats none, but the factor you choose determines how much protection you get. FIDO2 security keys and passkeys are cryptographically bound to the legitimate service, which makes credential phishing and adversary-in-the-middle attacks ineffective, and v3.3 recognizes them as MFA in their own right. Hardware tokens suit staff without a work phone or working where personal devices are banned, and SMS is a last resort. With MFA enforced, set the password minimum to 8 characters with no maximum, drop forced expiry and complexity rules, and record which password-quality control you rely on, because the question set asks.

6. Test, Document, and Prepare for the Annual Reassessment

Test each MFA path yourself before you submit, including enrolment for a new starter and account recovery, and confirm no route into a cloud service bypasses the second factor. Keep screenshots of policy configuration and a record of coverage by service and account type, since a Cyber Essentials Plus assessor verifies what you declared. Certification is a point in time judgement taken on the date the certificate is issued, and the director’s declaration now commits you to maintaining the controls throughout the period, so review coverage whenever you add a service or change your access model.

Cyber Essentials MFA Best Practices

• Treat cloud MFA as a pass-or-fail control: Audit every cloud service against every account type before you register. A single administrative or third-party account without MFA is enough to fail, and the marking criteria give an assessor no room to weigh it against your other answers.
• Cover your own infrastructure, not just SaaS: Extend MFA to VPN, Remote Desktop, Windows logon, and network device administration. These are in scope, they are where UK breaches most often begin, and they are what Cyber Essentials Plus testing probes.
• Choose phishing-resistant factors for administrators: FIDO2 keys and passkeys defeat the credential phishing and adversary-in-the-middle attacks that intercept one-time codes, and v3.3 recognizes them explicitly. Reserve SMS for accounts where nothing else is workable.
• Bring third-party and MSP accounts into the policy: Accounts your organization owns are in scope even when a supplier uses them. Make MFA a contractual condition of support access and verify it rather than assuming your provider enabled it.
• Plan enrolment, recovery, and leavers before rollout: Decide how a new starter enrols, how someone who loses a device regains access, and how factors are revoked at exit. Recovery processes that quietly bypass MFA are both an audit finding and a live vulnerability.
• Diarise the annual scheme update: The requirements are reviewed every year and changes normally take effect each April. Check the current Requirements for IT Infrastructure and question set before every renewal rather than assuming last year’s answers still pass.

How LoginTC Helps with Cyber Essentials MFA Compliance

LoginTC addresses the User Access Control requirement across the full scope of an assessment, not just the cloud portion. It integrates through RADIUS, LDAP, and Active Directory, so MFA can be enforced on Cisco, Fortinet, and Palo Alto VPNs, Remote Desktop Gateway, AD FS, firewall and router administration, and on-premises applications, all under one policy alongside your cloud services. For organizations whose exposure sits in the systems they run themselves, that is the difference between a partial deployment and a defensible one.

LoginTC supports MFA on domain and local administrator accounts and on Windows logon, which addresses the administrative account expectations in User Access Control and the default weak point named under Secure Configuration. RADIUS-based authentication in front of firewall and network device management interfaces satisfies the Firewalls theme requirement for internet-facing administrative access. FIDO2 security keys deliver the phishing-resistant factors v3.3 recognizes as MFA, and hardware tokens cover staff without a work phone or working where personal devices are prohibited.

Detailed authentication logs and centralized policy administration give a Cyber Essentials Plus assessor what they need to confirm MFA is enforced rather than declared, and give your director the evidence to sign the annual declaration. Cyber Essentials sets no requirement on how your MFA solution is hosted, and on-premises deployment keeps authentication infrastructure inside your own environment where data residency or network segregation demands it.

Frequently Asked Questions About Cyber Essentials

Does Cyber Essentials require MFA?

Yes. The User Access Control theme of Requirements for IT Infrastructure v3.3 requires MFA wherever it is available, and states that authentication to cloud services must always use it. Since April 2026 missing MFA on an in-scope cloud service is an auto-fail question, so the whole assessment fails regardless of other answers. MFA is also the primary permitted control for internet-facing firewall administration and is expected on administrative accounts.

Who does Cyber Essentials apply to?

Cyber Essentials is open to any organization, and the NCSC recommends it as the minimum standard for organizations of all sizes. It is contractually mandatory for suppliers bidding on central government contracts within Procurement Policy Note 014, which covers contracts handling citizens’ or government staff personal data or ICT systems at the OFFICIAL classification. It is also commonly required by the MOD, the NHS, and devolved and local government, and it cascades to sub-contractors handling the same data.

What types of MFA are acceptable under Cyber Essentials?

Cyber Essentials defines MFA as authentication using two or more verification factors and lists four additional factor types alongside a password: a managed or enterprise device, an app on a trusted device, a physically separate token, and a known or trusted account. FIDO2 authenticators and passkeys are regarded as MFA in their own right under v3.3, and biometrics, security keys, smart cards, push notifications, and one-time codes are recognized. SMS is accepted, but the NCSC advises a stronger method where one is available.

Does Cyber Essentials require MFA on VPN and Remote Desktop?

In effect yes, wherever MFA is available on those systems. The requirement applies across your declared scope rather than only to cloud services, and remote access sits squarely inside it. Internet-facing administrative interfaces must be protected by MFA or a restricted IP allow list. Since remote access and Remote Desktop are among the most common initial access routes in UK ransomware incidents, an assessor is unlikely to view an unprotected VPN or RD Gateway favourably.

Can a Canadian or other non-UK organization certify to Cyber Essentials?

Yes. Any organization can achieve Cyber Essentials provided the assessment is carried out by a certification body based in the UK or the Crown Dependencies, and overseas applicants are allocated one automatically on application. This route is used by non-UK firms bidding for UK public sector or defence work and by international groups certifying a UK subsidiary. The cyber liability insurance included with certification is limited to UK organizations with turnover under £20 million.

Does LoginTC need to be deployed a certain way to support Cyber Essentials?

No. Cyber Essentials sets requirements for authenticating access to your systems, not for how your MFA solution is hosted, so both cloud and on-premises LoginTC deployments support certification. On-premises deployment is often preferred by organizations with data residency requirements, segregated networks, or infrastructure that cannot rely on outbound connectivity, since it keeps authentication inside their own environment while still covering cloud services, VPN, and Windows logon under one policy.

Get a Free Cyber Essentials MFA Strategy Session

Cyber Essentials has moved MFA from a control that improves your score to one that decides whether you certify at all. Passing means accounting for every cloud service and every account within them, extending the same standard to the VPN, Remote Desktop, firewall administration, and Windows systems you run yourself, and holding that coverage for the twelve months your certificate is valid.

Our team helps UK organizations and their suppliers close authentication gaps before an assessment rather than after a failed one, including the on-premises and legacy systems cloud identity providers cannot reach. If you are certifying for the first time, renewing, or working towards Cyber Essentials Plus, we can help you map coverage and plan the rollout.

Book a Free Strategy Session