Cyber Essentials has always required organisations to keep on top of vulnerabilities and security updates. But changes introduced in April 2026 mean there is now less room for patching gaps to be picked up late in the process.
The latest requirements bring stricter marking around areas including multi-factor authentication and security update management, alongside changes to the way update management is tested during Cyber Essentials Plus assessments.
For channel partners supporting clients through certification, which puts more pressure on keeping environments up to date all year round, rather than waiting until an assessment is approaching.
Version 3.3 of the Cyber Essentials Requirements for IT Infrastructure came into effect for assessment accounts created after the 26th April 2026. The five core technical controls remain the same, but several areas are now marked more strictly.
Two questions relating to security update management are now classed as automatic failures. Organisations must install high-risk or critical security updates and vulnerability fixes within 14 days of a release across operating systems, router and firewall firmware and applications.
There are also changes to Cyber Essentials Plus assessments.
If an organisation fails the initial update management test on a random sample of devices, the issues must be fixed before a retest takes place. During that retest, the assessor will check both the original sample and a new random sample of devices.
If the organisation fails again, its verified self-assessment certificate will be revoked.
That makes it much harder to rely on fixing only the devices that happened to be selected during the first assessment. Update management needs to be consistent across the wider environment.
The declaration completed as part of the verified self-assessment has also been updated to make organisations responsible for maintaining compliance with Cyber Essentials controls throughout the certification period.
For MSPs managing several customer environments, keeping track of vulnerabilities manually can quickly become difficult. Devices change, software is updated and new vulnerabilities appear all the time. A client may have been fully compliant when its certificate was issued, but that does not mean the environment will stay that way without regular checks.
Finding those issues during the next Cyber Essentials Plus assessment is far from ideal.
Continuous vulnerability management gives MSPs a clearer view of what is happening across client environments, so issues can be picked up and dealt with earlier.
This is becoming more useful as Cyber Essentials places greater emphasis on maintaining good security practices between assessments, not only at the point of certification.
CyberSmart Vulnerability Manager gives MSPs visibility of vulnerabilities across client environments from one platform. Dashboards help teams identify new vulnerabilities and see where action is needed without relying on occasional manual scans.
For partners supporting clients with compliance, it provides audit-ready reporting aligned with frameworks including Cyber Essentials Plus, ISO 27001 and NIS2. The platform also prioritises critical vulnerabilities and provides remediation guidance, making it easier to see which issues need attention first.
Key benefits include:
For channel partners already delivering Cyber Essentials services, vulnerability management can become part of the ongoing service around certification. Partners can keep an eye on vulnerabilities throughout the certification period and deal with issues before they become a problem at the next assessment.
The April 2026 changes make regular vulnerability management more relevant for any organisation working towards, or maintaining, Cyber Essentials certification.
For channel partners, having better visibility across client environments can make it easier to spot issues early, support remediation and avoid unwanted surprises during an assessment.
CyberSmart Vulnerability Manager gives partners the tools to do that from one place, with reporting and guidance built around ongoing security and compliance. Brigantia partners can access CyberSmart alongside support from our team to help build vulnerability management into their wider cybersecurity offering. Get in touch to find out more.