Cyber Essentials deadline: check every login has MFA and every system still gets updates

If you started a Cyber Essentials assessment before 26 April 2026, the window to finish it under the old requirements closes this Monday, 26 October. Everyone else will meet the stricter v3.3 rules at their next renewal, and two of them matter most: MFA switched on wherever a cloud service offers it, and software that still receives security fixes. October also brought the last Exchange Server 2016/2019 security updates and a record Patch Tuesday, so now is a good moment to check what you actually run.

What changes on Monday 26 October?

According to Cybertec Security, organisations whose assessment account was created before 26 April 2026 were given six months to complete certification under the previous requirements. That window closes on 26 October. Any assessment still unfinished after that will need to move onto the current v3.3 requirements.

If your certificate is already issued, it stays valid until its expiry date. But as ITC Service explains, when you renew you'll be assessed against the current version of the scheme. So the deadline is a hard cut-off for a small group, and a preview of next year's renewal for everyone else.

If you're unsure which version your assessment falls under, ask your certification body before Monday rather than after.

What does the v3.3 MFA rule mean in practice?

Under v3.3, not having multi-factor authentication enabled on any cloud service where it's available is an automatic failure. That applies even if turning MFA on means paying for an extra licence or a higher plan.

The obvious place to start is Microsoft 365 or Google Workspace, and many firms have that covered. The gaps tend to be elsewhere:

• The CRM or sales tool someone signed up for on a card three years ago.
• Accounting, payroll and HR platforms.
• Hosting control panels, domain registrars and DNS providers.
• Customer portals and admin back-ends with their own usernames and passwords.
• Shared logins, where one account is used by several people and MFA was never set up because it was "awkward".

The rule turns on whether MFA is available. If a service offers it and it's switched off for any user, that's the problem an assessor is looking for. Shared accounts are worth fixing anyway: they make it impossible to tell who did what.

Why does "still supported" matter so much this month?

Two things happened on 13 October.

First, Microsoft released what it describes as the last Exchange Server 2016 and 2019 security updates for customers enrolled in the Period 2 Extended Security Update programme. Both versions have been out of mainstream support for a full year already. From November, on-premises servers running them get no new fixes at all, whatever is discovered next.

Second, October's Patch Tuesday was enormous. Qualys calls it Microsoft's largest security update ever, addressing 1,414 vulnerabilities, 78 of them critical. CrowdStrike counts slightly differently, at 1,413, including one zero-day already being exploited and two publicly disclosed. It also highlights critical flaws in cloud services, including a Microsoft Bookings elevation of privilege vulnerability rated 9.9 out of 10.

Cyber Essentials expects critical security updates to be applied within 14 days of release. For this batch, that window has just closed. If your patching depends on someone remembering to click "update" when they get a spare moment, a month like this shows why that doesn't scale. And software that no longer gets updates can't be patched at all, which is why support status is worth checking with your certification body before renewal.

What about the software you had built for you?

This is where many security checks stop short. Off-the-shelf software gets updated by its vendor. Custom software only gets updated if someone is responsible for it.

If you have a bespoke customer portal, booking system, internal admin tool or an app built quickly with AI tools, ask three questions:

1. Does it have MFA? If staff or customers log into a cloud-hosted system you own, treat it the same as any other cloud service. Adding MFA to an existing login system is usually a contained piece of work, not a rebuild.
2. What is it built on, and is that still supported? Every app sits on a framework, a database and a server or hosting platform. Each has its own end-of-support date, and they don't line up neatly.
3. Who applies its updates? If the original developer has moved on, the honest answer may be "nobody".

Apps built with AI coding tools deserve a particular look. They often reach real users quickly, sometimes before anyone has thought about login security or how dependencies get patched. Our AI app launch checklist covers the basics. For older systems that need MFA added or a framework upgrade, that's the kind of work our bespoke business software team does in short, prioritised sprints.

Why bother if your certificate is still in date?

Because the certificate is a snapshot, and attackers don't wait for your renewal.

ICAEW reports that only 25% of UK businesses and 19% of charities have an incident response plan in place. It also notes that SMEs often lack the financial resilience to absorb a ransom, which makes an attack potentially existential. Separately, Secarma reports research finding that 37% of ransomware attacks now involve psychological or physical threats aimed at people connected to the targeted organisation.

MFA and patching reduce the chance of getting in. Tested backups and a written plan decide how quickly you get back out. The NCSC's small business guidance on response and recovery is a sensible starting point for the plan.

One line for completeness: the Cyber Security and Resilience Bill also reaches report stage in the Lords on 26 October. It mainly concerns essential services and their suppliers, so for many SMEs its effect will be indirect.

What should you do next?

Work through these in order. None of them needs a big project.

1. Check your assessment date. If you started before 26 April and haven't finished, complete it by Monday or plan to redo your answers under v3.3.
2. List every login. Microsoft 365, CRM, finance tools, hosting panels, domain registrar, customer portals, admin back-ends. Mark whether MFA is on for every user, and get rid of shared accounts where you can.
3. Build a support-status inventory. Servers, any on-premises Exchange, database versions, and the frameworks your custom apps run on. Note the end-of-support date for each.
4. Plan moves off anything unsupported. Break it into small steps, ranked by risk: on-premises Exchange first if you still run it, then older frameworks and databases.
5. Automate patching where you can. A record month like October is a good test of whether your current approach would cope.
6. Test a restore and write a one-page incident plan. Who to call, where the backups are, how to reach staff if email is down.

If you'd like a second pair of eyes on the inventory, our consultancy and support service includes architecture reviews and support-status checks for systems built on .NET, SQL Server, MySQL and cloud hosting.