IASME and the NCSC have positioned these as refinements rather than a major overhaul, but several specific changes have real teeth. If you have been coasting on last year's setup, the new rules around cloud services and authentication will catch you out.

What Is Actually Changing?

2. Formal Cloud Service Definitions

For the first time, v3.3 provides a strict definition for cloud services. If your data sits in a service hosted on shared infrastructure, it is in scope. You can no longer exclude tools just because they are managed by a third party.

3. Scoping Language Simplification

Terms like "untrusted" and "user-initiated" have been removed. The 2026 rules are simple: if a device can establish or accept an internet connection, it is in scope. Where you want to exclude a network segment, you need clear justification and evidence of proper segregation.

4. Passkeys and Passwordless Authentication

Version 3.3 explicitly recognises passkeys as the NCSC preferred default. While not mandatory today, adopting FIDO2 authenticators and biometrics now will future-proof your business against upcoming tightenings of the scheme.

Why This Matters Beyond Compliance

Cyber Essentials is often mandatory for government contracts, but it also triggers free cyber liability insurance up to £25,000 for UK firms with a turnover under £20 million. Certification helps address the most common route into small business systems: credential theft.