yisadmin

Staying safe online can feel like a moving target. As technology moves forward, the rules we follow to protect our businesses have to keep up. The latest update to the UK’s primary security standard, Cyber Essentials v3.3 (also known as the "Danzell" update), is now in force for 2026.

We know that keeping up with certifications can sometimes feel like a chore. However, these updates are helpful because they address the real-world risks we face today, particularly with the rise of Artificial Intelligence (AI).

At Your IT Specialist, we believe security doesn't have to be complicated. We're here to help you understand what's changed and how we can adapt your IT support to meet these new standards. Here are the five most significant changes you need to know about.

1. AI Tools are Now Formally "In Scope"

For a long time, tools like ChatGPT or Microsoft Copilot were seen as optional extras. Many of us used them for drafting emails or summarizing meetings without thinking much about the security side. Under the new v3.3 rules, this has changed.

Any AI service that stores or processes your business data is now officially classed as a "cloud service." This means we can't leave them out of your security assessment anymore. If your team uses AI for work, that tool is now part of your protected digital perimeter.

Why this matters

If an AI tool is "in scope," it must meet the same security standards as your email or your file storage. This includes having strong passwords and proper access controls.

How we can move forward

Instead of worrying about which tools are safe, we can help you create a "Sanctioned AI List." We'll look at the tools your team loves and ensure they're configured securely. If a tool doesn't meet the requirements, we can suggest safer alternatives that keep your data private while still giving you all the benefits of AI.

AI governance and cloud security minimalist illustration

2. The Zero-Tolerance Rule for Multi-Factor Authentication (MFA)

We've talked about MFA many times before. It's the extra step where you confirm your login on your phone or with a physical key. In previous versions of Cyber Essentials, there were some small exceptions for where MFA was required. Those exceptions are now gone.

Under v3.3, if a cloud service offers MFA, you must use it. If we leave it turned off for even one account, the business will automatically fail the assessment. This applies to every user account that accesses your data: from the CEO to the newest intern.

Our shared solution

We understand that typing in codes all day can be a bit frustrating. To help, we can implement "Single Sign-On" (SSO). This lets you log in once securely and then access all your tools, including your AI and cloud apps, without needing a new code every five minutes. It’s a great way to stay secure without slowing down your day.

Multi-factor authentication and identity protection illustration

3. The 14-Day Patching Window is Now Essential

Security "patching" is just a fancy way of saying "software updates." When a software company finds a hole in their security, they release a patch to fix it. Hackers know about these holes too, so the race is on to fix them before they're exploited.

The v3.3 update is very clear: any "Critical" or "High" severity updates must be installed within 14 days. If we miss this window, it's considered a significant security risk.

Making it easy

We don't expect you to keep track of every update for every piece of software you own. That's what we're here for. We use automated tools to monitor your systems. When a critical update is released, we can often apply it in the background or during our out-of-hours support sessions. This means your team isn't interrupted by "Update and Restart" messages during important meetings.

14-day security patching and vulnerability management icon

4. Embracing Passkeys and Modern Identity

As part of the v3.3 update, the UK government is encouraging us to move away from traditional passwords where possible. They're now explicitly recommending "Passkeys" and FIDO2 hardware keys.

These are much harder for hackers to steal than a standard password. A passkey uses your thumbprint, face, or a physical USB token to prove who you are. It’s faster for you and much safer for the business.

How we help you switch

Transitioning to a passwordless world can feel like a big jump. We can start by setting up these modern keys for your most important accounts, like your administrative logins or your financial software. We'll guide your team through the setup so it feels like a helpful upgrade rather than a technical hurdle.

5. Better Mapping of Your IT Assets

To protect your business, we need to know exactly what we're protecting. The new rules require a more detailed "Asset Inventory." This is a list of every laptop, server, and cloud service your business uses.

The v3.3 update asks us to be more rigorous about why we might exclude certain items from our security checks. For example, if you have a separate network for guests in your office, we now have to prove exactly how it's kept separate from your main business data.

A clear view of your business

We can perform a full vulnerability assessment to map out your entire network. This doesn't just help with certification; it helps us find ways to make your IT run more smoothly. By knowing exactly what hardware you have, we can better plan for upgrades and avoid unexpected breakdowns.

IT asset inventory and cloud services mapping illustration

How Your IT Specialist Supports Your Certification

We know that certifications like Cyber Essentials can feel like a lot of paperwork. Our goal is to take that weight off your shoulders. We offer a range of security support services designed specifically to meet these 2026 standards:

  • Firewall & Antivirus Management: We ensure your first lines of defence are always active and correctly configured.
  • Automated Patching: We handle the 14-day update rule so you don't have to.
  • Vulnerability Assessments: We scan your systems to find and fix weak spots before they become problems.
  • Impartial Consulting: We give you honest advice on which AI tools and security software are best for your specific needs, without pushing expensive brand names.

Looking Ahead Together

Cyber Essentials v3.3 isn't just about passing a test; it's about making sure your business is resilient in a world where AI and cloud tools are everywhere. We can't stop the threats from evolving, but we can definitely make sure we're prepared for them.

If you're worried about your next assessment or just want to make sure your AI tools are set up correctly, let's have a chat. We're here to provide the IT consulting and support you need to keep your business running smoothly and securely.

Why not start with a quick review of your current MFA settings? It’s a small step that makes a massive difference. We’re ready to help whenever you are.