New Cyber Essentials requirements coming into force from today could trigger a sharp rise in certification failures, according to Cloudhouse.

To support organisations ahead of the deadline, Cloudhouse has launched a free Cyber Essentials readiness assessment, designed to identify patching gaps, configuration drift, and weak identity controls before they result in automatic failure.

The updated framework introduces a significant shift in how organisations are assessed. Under the new rules, businesses will automatically fail certification if they miss a 14-day window for applying critical patches or fail to enforce multi-factor authentication (MFA) across cloud services where it is available.

For many organisations, the challenge will not be awareness of the rules, but the ability to meet them consistently across complex environments.

“Cyber Essentials has stopped being a point-in-time exercise and has become a test of day-to-day operational control,” Mat Clothier, CEO at Cloudhouse commented.

“The risk is that organisations assume they’re compliant, only to fail instantly because of a missed patch or a gap in MFA coverage. That’s exactly why we’re offering the readiness assessment – to give teams a clear view of where they stand before they’re tested.”

Recommended reading

• NHS Scotland Invests £3M in AI Anti-ransomware Software
• UK Gov Urges Small Businesses to Adopt Cyber Essentials in New Campaign
• UK Facing 4 Major Cyber-Attacks Each Week, Warns NCSC
• New Bill Targets Cyber Threats to UK Infrastructure

The new requirements also expand the scope of certification, bringing all cloud services that store or process organisational data into consideration. Combined with stricter enforcement of patching timelines, this significantly increases the likelihood of gaps across large or distributed IT estates.

For organisations managing legacy applications and complex dependencies, meeting the 14-day patching requirement in particular presents a major operational hurdle.