Cyber Essentials v3.3
What changed, in plain English
The v3.3 requirements have applied since 27 April 2026. Here is what that means for clients on Microsoft 365.
Cloud services are always in scope
You can no longer leave cloud services such as Microsoft 365 or third-party SaaS apps out of the assessment. Every cloud service the organisation uses must be declared and meet the controls.
How Halberd helps: Halberd lists every third-party app connected through Microsoft sign-in, with publisher and permissions, so you can declare them or remove them.
MFA for every user of every cloud service that offers it
If a cloud service supports multi-factor authentication, it must be enabled for all users of that service. Missing MFA is an automatic fail.
How Halberd helps: Halberd checks MFA registration per user and whether Security Defaults or Conditional Access actually enforce it — including admins and legacy authentication.
High and critical updates within 14 days
Security updates rated high or critical must be installed within 14 days of release, on every in-scope device.
How Halberd helps: With Intune, Halberd flags devices that have not checked in for more than 14 days. Without Intune, it gives you a manual checklist.
Unsupported software is an automatic fail
Operating systems and applications that no longer receive security updates must be removed or upgraded (or segregated out of scope).
How Halberd helps: Halberd compares Intune device OS versions with a reviewed table of supported versions and shows the review date in every report.
Lapsed certificates: the 30-day rule
If a certificate has expired for more than 30 days, the organisation must complete a full new assessment rather than a renewal.
How Halberd helps: Halberd tracks each client's expiry date and reminds you at 60, 30, 14 and 7 days, and again if a certificate lapses.
This page is a summary for planning purposes. Always check the official requirements and question set from the NCSC and IASME.
Important: Halberd is a readiness aid and does not issue or guarantee Cyber Essentials certification. Certification is awarded only by an IASME-licensed certification body after assessment. Halberd is not affiliated with or endorsed by the NCSC or IASME.
See where a client stands in minutes
Free Cloud scope & MFA check for one client tenant. No card needed.