Renewal time comes round and the tempting plan is to open last year’s answers, check they still look right and send them off. This time that plan is riskier than usual. The requirements were due to change at the end of April 2026, and IASME names two areas as automatic fails: multi-factor authentication on cloud services and prompt patching. Every other answer still has to pass as well.
Which version you’ll be assessed against
The scheme’s announcement of 12 February 2026 says version 3.3 of the Requirements for IT Infrastructure applies to assessment accounts created after 26 April 2026, with a new question set called Danzell. An account opened before that date keeps the previous version and has six months to reach certification. So what decides it is the date your assessment account is created, not the date your certificate expires.
An earlier article from 3 November 2025 gives 27 April for the same switch. A day’s difference only matters if you’re opening an account that week, but it’s a good reason to confirm the date with your certification body rather than rely on either article.
The other timing rule is easy to miss. IASME’s renewal guidance says a new certificate is valid for 12 months from the date you submit, not from the expiry of the old one. Submit three weeks early and you lose those three weeks, so find your expiry date before you start and plan the submission around it.
Two areas where failure is automatic
Failing to meet the required standards fails an assessment, which is the general rule. On top of that, the announcement names two areas where failure is automatic. The first is multi-factor authentication, which it describes as mandatory for all cloud services where it’s available, whether the option is free, included in your plan or paid for.
That reaches well beyond email. We’d treat anything that fits the definition under the scope heading below as covered, so list the accounting package, the customer database and the file-sharing service, and ask of each whether MFA is switched on for every account that can sign in, including the shared one somebody set up years ago.
The second is patching. Two questions, A6.4 for operating systems and the firmware on routers and firewalls, and A6.5 for applications, require high-risk or critical security updates and vulnerability fixes to be installed within 14 days of release. Failing either one fails the assessment. Think of a router in the comms cupboard that nobody has logged into since it was installed, or an old copy of a desktop application nobody remembers installing.
IASME says the point in time is the date the certificate is issued. So software that’s still supported when you start but out of support before issue is a problem, and it’s worth checking vendors’ end-of-support dates against your timetable.
Scope is where arguments start
Scope decides what the assessor looks at, and the announcement describes several changes to it. It defines a cloud service as “an on-demand, scalable service, hosted on shared infrastructure, and accessible via the internet”, and says cloud services cannot be excluded from scope. In practice we’d treat any service you sign into that holds or processes your data as covered, and we wouldn’t try to leave it out.
The words “untrusted” and “user-initiated” are gone from the description of internet connections. If you want to leave part of the network out, you have to justify it and explain how it’s kept separate from the part that’s in. The paperwork is more visible too. Scope descriptions are no longer length-limited and show on the digital certificate platform, while out-of-scope areas must be described but aren’t public. Every legal entity in scope has to be listed with its name, address and company number, which catches groups of companies. If two entities share staff and systems, decide early whether both belong in the certificate.
Who signs, and what they’re signing
The declaration, which a board member or director signs, acknowledges responsibility for maintaining compliance with all the controls throughout the certification period. That changes what the signature means. It covers the whole period, not only the day you submitted, so we’d make sure somebody owns the checks that keep MFA, updates and the removal of leavers’ accounts in order for the following twelve months.
If you’re going on to Cyber Essentials Plus, IASME’s note on the change says the self-assessment answers must be completed, finalised and left unchanged before testing begins. A failed sample of devices for update management means fixing the problem and a retest of the original sample plus a new random one, and a second failure revokes the verified self-assessment certificate.
A pre-check worth doing before you open the account
For a small organisation we’d keep this simple. Before opening the account, list every cloud service and confirm MFA on each, then go through your devices and network equipment for anything out of support or more than 14 days behind on critical or high-risk updates, router and firewall firmware included. A single page of findings is enough to work from. If you have several sites, more than one legal entity or a mix of managed and unmanaged devices, it’s worth having someone independent look at it, because those are the situations where the automatic-fail items are easiest to miss.
That’s the sort of work covered by preparing for Cyber Essentials, and it leans on configuration and access reviews. Where agreed in the scope, we can also set out your scope in writing as an assessor would read it, with the legal entities and the reasons for anything left out. We can’t award certification, though. Assessments are carried out by a certification body licensed by IASME, so we treat this as preparation rather than a result.
If you’re not sure which version your renewal will land on, or whether your cloud accounts and firmware would clear the automatic-fail checks, get in touch and we can talk through where to start.
