The rules are changing. Every UK business renewing or applying for Cyber Essentials from 27 April 2026 must meet the new v3.3 requirements — or fail certification.
Personal phones that access work email are now in scope. Cloud services are now explicitly in scope. The rules on BYOD, home working, and remote access have all been tightened. Don't find out you're not compliant on assessment day.
Cyber Essentials has been around since 2014. Many organisations assume that because they passed last year, they will pass again this year. That assumption is now dangerous.
The v3.3 update is the most significant change to the scheme in years. The NCSC and IASME have tightened scope definitions, clarified BYOD requirements, and sharpened the rules on cloud services and remote working.
Here is what organisations typically get wrong:
The result: certifications fail. Government contracts are at risk. Cyber insurers ask harder questions.
The solution is straightforward — if you know what to do.
Every document in this pack has been written by Michael Adedeji — CISM, CISA, CEH, CC — with over a decade of cybersecurity practice across UK public and private sector organisations. These are not generic templates. They are built specifically for Cyber Essentials v3.3 and designed for UK businesses of 1 to 250 employees.
Identify your weaknesses before the assessor does.
Exactly what to configure, in plain English.
New v3.3 scope rules explained step by step.
What assessors check — and why organisations fail.
A structured assessment covering all five CE controls against the new v3.3 requirements. Identify your gaps before your assessor does. Includes scoring, gap narrative, and recommended actions.
A detailed pre-assessment checklist covering every control, every sub-requirement, and every evidence item you need to collect before submission. Print it, work through it, tick it off.
Multi-factor authentication is now required for all cloud services in scope under v3.3. Covers enabling MFA in Microsoft 365 and Google Workspace, what counts as acceptable MFA — and what does not.
A ready-to-use procedure meeting CE v3.3 requirements. Covers Windows, macOS, mobile, cloud services, firmware, and browser extensions — with a patch log template your team can use immediately.
The v3.3 scope rules explained in full — including BYOD, cloud services, remote workers, and home workers. Includes a scope statement template you can complete and submit with your application.
What happens on CE and CE+ assessment day. What assessors check for each of the five controls. The most common reasons organisations fail — and what evidence to prepare. Includes day-of checklists.
Ideal for: organisations that want to run a quick gap check and understand where they stand before committing to full certification preparation.
Buy Starter Pack — £97Ideal for: organisations actively preparing for Cyber Essentials or CE+ under v3.3. Everything you need in one download.
Buy Full Pack — £297Ideal for: complex infrastructure, upcoming CE+ assessments, or organisations that have previously failed Cyber Essentials.
A CISM + CISA qualified assessor's time typically costs £500–£1,000/hour. At £797 for the pack plus the call, this is exceptional value.
Book Full Pack + Review Call — £797If your certificate expires after 27 April 2026 or you are renewing after that date, yes. The v3.3 requirements apply from that date and the scope rules — particularly around BYOD and cloud — have changed significantly.
Both. Documents 01–04 apply to both. Document 06 covers CE+ specifically, including what happens during the verified assessment day.
Written for UK businesses of 1 to 250 employees. Relevant for sole traders, SMEs, charities, and public sector bodies of similar scale.
No. This pack prepares you for certification. The actual Cyber Essentials assessment must be conducted through an IASME-authorised certifying body. The pack ensures you are ready before you go through that process.
The Starter and Full Pack are document-based downloads. For questions, email info@pyralink.co.uk. For hands-on help, the Full Pack + Review Call at £797 is the right option.
Markdown format (compatible with Word, Google Docs, Notion, Confluence). Formatted for immediate use — complete the templates, add your organisation name, and use them directly.
Immediately after purchase. A download link will be emailed to you automatically.
27 April 2026. From this date, all Cyber Essentials assessments must be conducted against the v3.3 requirements. If your current certificate predates v3.3, your renewal will be assessed against the new standard.
Don't arrive at your assessment day and discover your BYOD devices are in scope, your cloud platforms are not configured correctly, or your patch management process doesn't meet the 14-day requirement. Get the pack. Know where you stand. Fix it before the assessor finds it.