Cyber Essentials is no longer a tick-box exercise businesses need to act now

Date:
Thu, 27 Aug 2026 08:55:11 +0000

Description:
The latest Cyber Essentials overhaul is raising the bar for businesses of all sizes.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter When was the last time you reviewed your cyber security standards? Lets be clear: keeping a company secure is a constant task.

Cyber breaches are on the rise; according to the latest UK Government Cyber Security Breaches Survey, 4 in 10 businesses were compromised in the last 12 months. Its important to remember businesses of all types and sizes are at risk where there are gaps in security, attackers will take advantage.
Against this backdrop, plus high-profile cyber-attacks on companies including M&S and JLR, the government has reviewed its Cyber Essentials framework. Latest Videos From TechRadar Watch full video here:

Its latest overhaul is raising the bar for organizations of all sizes. David Robinson Social Links Navigation

Head of cyber security at Restore Information Management. Designed to provide the basic controls to protect businesses and their staff, if taken seriously, Cyber Essentials can make all the difference. Yet many businesses are still struggling to meet even baseline security standards. You may like Avoiding
the auto-fail under cyber essentials new rules The biggest cyber threats businesses face in 2026 Rethinking cyber defense in government with
continuous exposure management

Common issues such as a lack of budget, limited resources and a focus on
other priorities are all factors holding organizations back and they all
make a major IT breach more likely.

Historically treated as a once-a-year compliance exercise, the latest Denzel Cyber Essentials framework signals a clear and overdue shift towards implementing continuous cyber resilience. This means tougher standards which could catch businesses out. Are you a pro? Subscribe to our newsletter Sign
up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

Here are the key changes and how to approach them, to reduce the risk of a breach. Implement a robust patching regime Under the new framework, expectations have been tightened around patch management the process of fixing a security risk or software error by installing updates and vulnerability management.

Previously businesses could demonstrate compliance with patching requirements though documented processes and periodic updates. What to read next The cyber risk hiding in plain sight The ascent of autonomous attacks and the race to contain them AI is making cyber threats faster, but trust will define which businesses survive

In reality, teams find it hard to build in regular patching routines which work without affecting live services, due to downtime and continual testing. And thats without taking into consideration all the third-party patches that need to be applied, as well as the critical operating system ones.

There is evidence that not addressing application issues and vulnerabilities is leading to more breaches. The 2026 Verzion Data Breach Investigations Report shows system compromise is now up to 61%, the highest its been over
the last three years.

Timelines for applying critical patches have been made stricter, with a
14-day window to comply. Critical patches must be deployed consistently
within this period, and businesses must be able to evidence their patching regime is working.

Companies will be afforded two chances to prove patches have been
successfully deployed using a process called double sampling. If the first round of evidence has critical issues identified, a second chance will be given to fix it and prove it has worked if it hasnt, businesses will fail their certification.

IT teams should review systems now to determine if everything is being
patched within the 14-day window. If not, they will need to work closely with operational teams to build up to the requirements in time for the next assessment. Deploy Multi Factor Authentication (MFA) across the board MFA remains one of the most effective controls against account compromise. The issue for many organizations is not a lack of MFA capability, but
inconsistent deployment.

Businesses are likely to have MFA enabled for remote access such as Virtual Private Networks (VPNs) and Microsoft 365 services but admin interfaces, cloud platforms and third-party services often do not follow the same practice, leaving companies exposed. Threat actors know this and use these weaknesses to try to gain access.

Under the new framework, if you have a cloud system which supports MFA then
it must be enabled for all users, irrespective of whether its a free,
included or paid-for option. Without MFA enabled, its an automatic certification failure.

This begs the question: do you know if MFA is enabled on all your cloud services? If not, how long will it take to turn this around? Cloud services must be accounted for Under previous versions of the framework, cloud
services could be excluded from the assessment as it was argued they sat outside of the scope. This argument is no longer viable. Organizations need
to provide a clear, well-defined document with evidence to support proper segregation of all IT Systems, otherwise they will automatically be viewed as within scope.

This means businesses must account for all services, regardless of where they are hosted. Given the flexibility of cloud solutions, this can quickly become a complex issue to gain appropriate visibility of all systems. If you are processing or storing data in a cloud service, this will be included. Typically, these are CRM platforms , HR software and financial systems, project management solutions , plus many more.

As it can take time to discover whats in use and in scope, this is another area where organizations need to leave plenty of time to ensure all cloud services are covered. Replace legacy hardware and update operating systems A major change, and possibly the greatest headache, is the requirement to replace ageing hardware and software.

Recent retirement of the Windows 10 operating system is one area where businesses are under pressure to replace all their hardware to remain compliant. It doesnt stop there ageing IT infrastructure , along with major vendor services and solutions, all need to be replaced at some point. If organizations dont plan ahead, they could be left with a mounting problem and not enough time to deal with it.

Once a vendor stops supporting a platform, the risk of a breach increases until this is addressed. Security patches will no longer be made available
and given the time these systems have been out in the wild, its only a matter of time before another vulnerability is discovered and exploited.

In the short term, businesses should ensure they have a clear view of their assets in scope of Cyber Essentials and check vendor support dates (and when these run out) to avoid any hidden surprises at the last minute. In the long-term, a robust strategy for replacing all hardware as it is approaching end of life will save difficulty further down the line. Dont delay on a gap analysis Core areas in the Cyber Essentials framework have been updated to reflect the fast-changing security landscape. Its not all bad news, as businesses have time to turn things around. Organisations should read carefully through the new standards and consider how they apply to their own company.

Do not treat Cyber Essentials as a tick-box exercise and wait until a month before your next assessment. Do a gap analysis now and deal with the
findings.

At the end of the day, it is absolutely worth the effort. The best internet security suites for PCs, Macs and mobile devices, reviewed by the experts . This article was produced as part of TechRadar Pro Perspectives , our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit



======================================================================
Link to news story: https://www.techradar.com/pro/cyber-essentials-is-no-longer-a-tick-box-exercis e-businesses-need-to-act-now


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)