Is Your Small Business Compliant with the 2026 Cyber Essentials Update? A Wickford Guide

If you run a small business, cyber security now matters as much as your accounts. From 27 April 2026, new assessments under the UK’s National Cyber Security Centre (NCSC) certification scheme use updated requirements. If your company holds client records, takes payments or bids for public sector contracts, it's worth keeping up with these changes.

Compliance can feel like a lot without an in-house IT team. At LaunchLayer, we keep security advice practical and plain. Here are the main changes this year, and what to do about them.

1. What is Changing in the 2026 Cyber Essentials Framework?

The changes reflect how businesses work now. The baseline has tightened around cloud services, more convincing AI-written phishing, and the risks that come with staff working from home.

Keep your cloud apps secure

If your business uses cloud apps to hold customer details, those services can't be left out of the assessment, and multi-factor authentication must be switched on wherever a cloud service offers it.

Stricter Requirements for Mobile Devices

Personal phones, tablets or laptops that staff use for work email or chat need to be set up securely too. In practice that means a screen lock (PIN or biometrics), up-to-date operating systems, and older, less secure settings switched off.

2. Small business IT support in Wickford: two practical security jobs

Getting compliant isn't about buying expensive enterprise software. It's about closing off the basic ways attackers get in. Two of the main ones:

Pillar 1: Enforcing True Multi-Factor Authentication (MFA)

A password on its own is easy to break or steal with automated attacks. Proper MFA adds a second check, ideally through an authenticator app rather than an SMS code, which can be intercepted, on every important system.

Pillar 2: Update or replace old software

Old operating systems and unpatched plug-ins leave open doors into your business files. Every app on your company devices needs regular updates, so known security holes are closed before anyone can use them.

Sort your security early

Sorting security early can save you the cost and disruption of a ransomware clean-up, and protects the reputation you've built locally. If you'd like help turning technical standards into clear next steps, we can help you get your business files properly secured.

Cyber Essentials requirements depend on the assessment you are taking. Check the current IASME and NCSC guidance, and ask your assessor which requirements apply. We can help you review the practical IT setup before you apply.

Want a hand getting ready for Cyber Essentials? Our small business IT support can help.