Fourteen days: what Cyber Essentials now expects your people to do

Fourteen days: what Cyber Essentials now expects your people to do

Cyber Essentials now fails organisations outright on patching and multi-factor authentication. Some of October’s training effort belongs with the people who run those controls.

Fourteen days is how long an organisation seeking Cyber Essentials has to install a high-risk or critical security update. For assessment accounts created after 26 April 2026, answering “no” to either of the two questions that ask about it fails the whole assessment. Multi-factor authentication (MFA), a second check beyond a password, was already a requirement for cloud services. Missing it where it is available is now an automatic fail too.

October is Cybersecurity Awareness Month, which makes it a natural point to ask where training effort should go. My argument is that more of it belongs with the people who run the systems, because the skills that decide whether an organisation passes Cyber Essentials sit with them. All-staff awareness has a place, and the evidence on what it can and cannot do is below.

What the government’s survey shows

The anchor here is the Cyber Security Breaches Survey 2025/2026, published on 30 April 2026 and commissioned by the Department for Science, Innovation and Technology (DSIT) and the Home Office. It is labelled as official statistics and rests on a random probability survey of 2,112 UK businesses and 1,085 UK registered charities, carried out between August and December 2025.

Its headline is familiar. Just over four in ten businesses (43%) reported a breach or attack in the previous 12 months, and phishing remained the most common type by far, experienced by 38% of businesses. Two other findings matter more for this argument.

First, 19% of businesses ran staff training or awareness raising activities on cyber security, the same share as the year before. Large businesses showed signs of an increase, from 76% to 84%, but the survey says that was not a significant change.

Second, awareness of Cyber Essentials was 17% among businesses, and 5% held the certificate, up from 3%. A larger share, 24%, reported technical controls in all five areas the scheme covers. Certification is still uncommon, but more businesses say they have the controls than hold the certificate. For those that go for it, the April changes set the terms.

What changed in Cyber Essentials

Cyber Essentials is delivered by IASME, the official delivery partner of the National Cyber Security Centre (NCSC) for the scheme. Its requirements document, Requirements for IT Infrastructure, is now at version 3.3, effective from 27 April 2026, and the self-assessment uses a new question set called Danzell. IASME says the changes apply to all assessment accounts created after 26 April 2026. An organisation with an active account created before then has six months to certify under the previous version.

The five technical controls are firewalls, secure configuration, security update management, user access control and malware protection. The changes that matter most here touch the third and fourth:

  • MFA on cloud services was already a requirement. Where it is missing on a service that offers it, whether free, included or a paid option, the assessment is now an automatic fail.
  • Two security update questions carry the same consequence. A6.4 covers operating systems and router and firewall firmware, and A6.5 covers applications. Each asks whether high-risk or critical updates have been installed within 14 days of release.
  • Cloud services have a formal definition and cannot be excluded from scope. Organisations must justify any other exclusions and explain how excluded networks are segregated from in-scope systems.
  • The declaration signed by a board member or director now includes a statement acknowledging the organisation’s responsibility to maintain compliance with all Cyber Essentials controls throughout the certification period.
  • IASME defines the “point in time” of the assessment as the date the certificate is issued.

Cyber Essentials Plus adds technical testing of a sample of devices, and it has tightened as well. IASME says recent audits found a small number of organisations had applied updates only to the devices in the test sample, rather than across their whole Cyber Essentials Plus scope. If an organisation fails the initial test of a random sample of devices, the assessor rechecks the original sample and also tests a new random sample. A second failure revokes the verified self-assessment certificate. Organisations can no longer adjust their self-assessment answers based on the results of the Cyber Essentials Plus assessment.

Why this is a skills question

Read as a list of tasks, those changes describe work that specific people have to do. Someone has to know every cloud service the business uses, including any a team signed up to without IT. Someone has to run a patching process that lands inside 14 days on every in-scope device, including the ones an assessor might never sample.

DSIT’s Cyber Security Skills in the UK Labour Market 2025 report gives a sense of how many organisations may lack those people. Its employer survey, with fieldwork between 31 July and 18 October 2024, found that nearly half of businesses (49%) had a basic skills gap, struggling with essential tasks including setting up firewalls, managing personal data securely and detecting malware. A footnote in the findings report defines basic technical skills as a combination of the technical areas covered by Cyber Essentials and other basic aspects of cyber security. The survey asked about confidence in carrying out tasks, because capability cannot be tested objectively in a survey, so the figure is self-reported.

The counterpoint: awareness training does less than we assume

The strongest challenge to this argument runs the other way. If awareness training achieves little, there is a case for dropping it, and the evidence for that case is serious.

Grant Ho and colleagues’ paper, “Understanding the Efficacy of Phishing Training in Practice”, was presented at the IEEE Symposium on Security and Privacy in May 2025. It describes an eight-month randomised controlled experiment: ten simulated phishing campaigns sent to more than 19,500 employees at UC San Diego Health. The authors found no significant relationship between having recently completed cybersecurity awareness training and the likelihood of failing a phishing simulation. Embedded training, the page shown to someone who clicks a test link, had a statistically significant but small effect: a 9.5% relative reduction in the likelihood of failing, equal to about 1.7 percentage points in the average failure rate across all users. Over half of training sessions ended within ten seconds, and between 37% and 51% ended with the page closed immediately. This is one US healthcare organisation, so it cannot settle the question for every programme, but it does not help the case for the annual module.

The NCSC makes a related case in its phishing guidance, first published in 2018 and last reviewed in February 2024. It says that training users, particularly through phishing simulations, is the layer that is often over-emphasised in phishing defences, and that no training package, including phishing simulations, can teach users to spot every phishing attempt. It also says simulations erode trust between employees and security, and suggests measuring how many people reported a phishing email as well as how many clicked.

So the counterpoint is real. My reading is that training for everyone is most useful as a way to get suspicious messages reported quickly, backed by technical controls that do not depend on anyone spotting anything. MFA and fast patching are such controls. The awareness budget still has a job.

What to do with October

The practical implication is modest: move some of this month’s effort to where the certificate is won or lost.

Keep the all-staff element and change its purpose. Teach people how to report and make reporting feel safe, then track reports alongside clicks. Spend the harder part of the month with the people who run the controls. Ask them to show you, on screen, the list of cloud services in scope and where MFA is enforced on each. Ask how long the last critical update took to reach every device, and where the evidence lives. Vague answers point to a gap. It may be a tooling or ownership problem, or it may be a skills problem, and only the last is a training need.

If the answer is a skills gap, name the skill. Enforcing multi-factor authentication across every cloud service is identity administration. Meeting the 14-day window for operating systems, firmware and applications is endpoint and network management, and it depends on an accurate list of what is installed where. Vendors publish role outlines that make such skills testable. Microsoft’s study guides for its identity and access administrator and endpoint administrator exams, for example, list multifactor authentication settings and Windows update management among the skills measured. Those outlines suit Microsoft environments, so an organisation on other platforms needs the equivalent. On any platform, the simplest test is to ask the person to do the task on screen.

For boards, the question has changed. The declaration a director signs now includes a statement acknowledging the organisation’s responsibility to maintain compliance with all Cyber Essentials controls throughout the certification period. That is a reasonable thing to ask, provided the people underneath have the skills to make it true. I would rather see an organisation spend part of October finding out whether they do than spend all of it on all-staff awareness alone.

This article is commentary on published guidance and statistics, not legal or certification advice. Check current requirements with IASME or a Cyber Essentials Certification Body. Sources checked on 2 October 2026.

Sources