Editorial correction — 14 October 2026: We reviewed the full article, retained verified assessment changes and removed unsupported breach narratives and predictions. The original publication date is unchanged. This is a guide to selected published requirements, not a certification assessment of your organisation.
Which assessment version applies?
IASME’s published update says the revised scheme applies to assessment accounts created after 26 April 2026. Accounts created earlier have six months to complete under the previous version. Check the actual assessment account and deadline; the date an organisation starts planning does not determine its assessment version.
The same update identifies stricter marking for cloud-service MFA and timely security updates. Available MFA must be enabled for cloud services, including where it is a paid option. The security-update questions cover the defined requirements across the assessment scope, rather than only a device selected for inspection.
Read the update threshold correctly
The NCSC’s version 3.3 requirements specify a 14-day deadline for relevant vulnerability fixes, including those described as critical or high risk, those meeting the stated CVSS threshold, and those without vendor severity details. Applying every update within 14 days is recommended, but that is distinct from the mandatory criteria. Check operating systems, applications and relevant device firmware against the actual standard.
Version 3.3 also clarifies scope and cloud services. The assessment should reflect the organisation’s actual systems and the services storing or processing its data. An inventory assembled only from a central purchasing list may be incomplete; our practical recommendation is to reconcile it with the services staff actually use and the relevant accounts.
Cyber Essentials Plus is not just the initial sample
IASME describes a change to retesting after a failed update-management sample: assessors recheck the original sample and a new random sample. A second failure results in revocation of the verified self-assessment certificate. Verified self-assessment responses must be finalised before Plus testing, rather than rewritten in response to its results.
The business implication is practical: remediation should address the defined scope, not merely the machines a tester has already examined. This article does not claim that every failed assessment has the same cause or that our team investigated any organisation’s breach.
Public procurement does not impose a universal rule
PPN 014 covers specified public bodies and risk characteristics of contracts. It permits equivalent controls and explicitly rejects applying Cyber Essentials to every contract automatically. Suppliers should check the particular procurement and its evidence requirements. Where certification is required, it must be renewed annually for the contract’s duration.
The PPN also explains the limits of the scheme: it does not assure an individual supplied product or eliminate cyber risk. A certificate should therefore be considered alongside the scope of the service and any additional assurance the contract requires.
ObvioTech assessment: keep operational evidence
Before renewal, record the assessment version and scope, identify unsupported software, verify the applicable update deadlines and check cloud-account MFA. Assign an owner for exceptions and remediation. Keep the evidence current rather than treating a questionnaire submission as the end of the work. These are preparation suggestions, not a claim that a particular tool or checklist guarantees certification.
