Independent UK Cyber Essentials guidance · v3.3 (Danzell)
Cyber Essentials, made practical for Microsoft 365 businesses
Find out in 10 minutes whether you’d auto-fail under this year’s rules, then fix it step by step. Free, from a team whose clients have never failed.
2026 automatic failures
This year’s three auto-fails
Under the Danzell marking rules introduced by the National Cyber Security Centre (NCSC) and IASME (the NCSC’s Cyber Essentials delivery partner) in April 2026, failing any of these three checks fails your whole application outright, regardless of your answers elsewhere.
Missing MFA on any cloud service
Where an online service offers Multi-Factor Authentication (MFA) — a second check such as an authenticator app or passkey — you must switch it on for every user. Even if the supplier charges extra for MFA, leaving it off is an automatic fail.
Late OS or router/firewall updates
High-risk and critical security updates for Windows, macOS, iOS, Android, and your office router or firewall firmware must be installed within 14 days of release. Unsupported operating systems or routers also block certification.
Late application or extension updates
Web browsers, office apps, PDF readers, video-calling tools, and browser extensions must also receive critical and high-risk security fixes within 14 days of release across every computer and phone in scope.
Starting point
Why are you here?
Most small businesses don’t wake up wanting a certificate — someone asks for one. Pick what triggered your search for a practical plan for this week.
My insurer asked
What cyber insurers look for at renewal, how the bundled IASME insurance works, and what to tell your broker if renewal is close.
Insurer guide →A tender needs it
How Procurement Policy Note 014 (PPN 014) works for UK government, NHS and Sell2Wales contracts, and whether you need Basic or Plus.
Public contracts guide →A defence customer needs it
The Ministry of Defence (MOD) Defence Cyber Certification (DCC) Level 0 target by 31 December 2026 and what subcontractors must put in place.
Defence & DCC guide →A customer sent a questionnaire
Which supplier security questions Cyber Essentials answers outright, and how to reply honestly while you are getting certified.
Questionnaire guide →The framework
The five controls
Cyber Essentials checks five technical controls across your organisation’s devices, networks and cloud accounts. Each guide below explains the rule in plain English and shows the exact fix in Microsoft 365, Windows and macOS.
1. Firewalls
Put every computer, server and network behind a properly configured firewall with default passwords changed and remote admin locked down.
Firewalls →2. Secure configuration
Remove unused accounts and software, change default passwords, switch off auto-run, and lock devices with a PIN, password or biometric.
Secure configuration →3. Security updates
Run only licensed, supported software and install critical or high-risk patches within 14 days on operating systems, firmware and apps.
Security updates →4. User access control
Give people only the access their job needs, keep admin accounts separate from email, close leavers’ accounts promptly, and turn on MFA.
User access control →5. Malware protection
Run active, self-updating anti-malware with web protection on computers, or restrict devices to approved, code-signed applications.
Malware protection →Interactive checks
Free tools
Our tools run in your browser and turn the v3.3 rules into a concrete action list for your business.
Auto-fail checker
Answer 25 plain-English questions to see which areas would auto-fail or be marked down under the 2026 rules, with the exact fix for each.
Scope builder
Work out which legal entities, offices, home workers, devices and cloud services are in scope, and spot unsupported systems early.
Evidence pack generator
Generate editable security policies and asset, admin and cloud registers tailored to a small Microsoft 365 or Google Workspace firm.
Renewal reminder
Certificates last 12 months. Enter your expiry date and get reminders at 90, 60 and 30 days with a summary of what changed in the rules.
Built for Microsoft 365
Most small firms run on Microsoft 365. We show you the exact settings.
The official guidance tells you the rule, such as “install critical updates within 14 days” or “use separate administrative accounts”. It doesn’t tell you which blade in Microsoft Entra ID (formerly Azure Active Directory) or Microsoft Intune actually does that, or which Microsoft 365 licence you need.
Every guide on Five Controls includes an In Microsoft 365 box naming the exact admin portal path and licence tier.
Example: mapping rules to Microsoft 365
- Cloud MFA auto-fail: Microsoft Entra admin centre → Protection → Conditional Access (or Security defaults on Business Standard).
- 14-day OS updates: Microsoft Intune admin centre → Devices → Windows → Update rings (quality update deadline ≤ 7 days, grace period 2 days).
- Separate admin accounts: Cloud-only
admin-*accounts in Entra ID with FIDO2 passkey or Authenticator MFA, and Windows LAPS for local admin passwords.
Run by AlphaSec
Practical help from a team whose clients have never failed
Five Controls is written and run by AlphaSec, the cyber security practice of Alphabyte IT Limited in Cardiff. We have looked after UK small businesses since 2009, manage around 60 Microsoft 365 tenants, are a Microsoft Partner and hold Cyber Essentials certification ourselves.
None of the clients we’ve prepared for Cyber Essentials has ever failed.
Popular buying guides
How much does Cyber Essentials cost in 2026?
IASME’s tiered fees (£320 to £600 + VAT), hidden remediation costs, and fixed-price preparation.
Cyber Essentials vs Cyber Essentials Plus
Self-assessment versus hands-on technical audit, the 90-day window, and the stricter 2026 retest rules.
Why firms fail Cyber Essentials
The mistakes that catch small businesses out and our pre-submission checklist.