The short answer
Cyber Essentials requires MFA wherever it is available, and authentication to cloud services must always use MFA. Under v3.3, IASME treats a cloud service that offers MFA without it switched on as an automatic fail, even when MFA is a paid option. SMS codes are accepted but are not the most secure option, and FIDO2 passkeys count as MFA.
On this page
- What is multi-factor authentication?
- Does Cyber Essentials require MFA?
- Which accounts need MFA for Cyber Essentials?
- Which factors count for Cyber Essentials MFA?
- Do SMS codes count as MFA for Cyber Essentials?
- Do passkeys and passwordless sign-in count as MFA?
- Which MFA answers fail Cyber Essentials?
- How does Cyber Essentials Plus test MFA?
- How do you get MFA ready before your assessment?
- Why Sovereign Secure?
- Next step
Cyber Essentials MFA rules are short but strict. Under the NCSC’s Requirements for IT Infrastructure v3.3, your organisation must implement multi-factor authentication (MFA) wherever it is available, and authentication to cloud services must always use MFA. IASME, the NCSC’s Cyber Essentials delivery partner, treats a cloud service that offers MFA without it switched on as an automatic fail. This guide covers which accounts need MFA, which factors count, whether SMS codes pass, where passkeys fit and how Cyber Essentials Plus checks it.
What is multi-factor authentication?
Multi-factor authentication (MFA) is a way of proving who you are with two or more different types of evidence, so a stolen password alone is not enough to sign in. Cyber Essentials v3.3 defines it simply as a method of authenticating a user that uses two or more verification factors.
The factors fall into three types: something you know (a password or PIN), something you have (a phone, security key or managed device) and something you are (a fingerprint or face). A password plus a code from an authenticator app is MFA. A password plus a memorable word is not, because both are things you know. Our explainer on two-factor vs two-step verification goes through the difference with examples.
Does Cyber Essentials require MFA?
Yes. The user access control requirements in v3.3 say your organisation must implement MFA where it is available, and that authentication to cloud services must always use MFA. For assessments under v3.3 and the Danzell question set, which apply to assessment accounts created from 27 April 2026, IASME has confirmed that failing to implement MFA on cloud services, whether it is free, included in your plan or a paid option, is an automatic fail, however well you answer everything else. Our guide to the Cyber Essentials changes for 2026 covers the other automatic-fail questions.
The paid-option point catches people out. If a service offers MFA only on a higher licence tier or as an add-on, it still counts as available. You can pay for it, sign in to the service through single sign-on from an identity provider that enforces MFA, or stop using the service for organisational data.
Which accounts need MFA for Cyber Essentials?
| Account or system | MFA requirement under v3.3 | Notes |
|---|---|---|
| Every user of a cloud service (Microsoft 365, Google Workspace, accounting, HR, CRM, file sharing) | Must always use MFA | Applies to every user, not only administrators |
| Administrator accounts on cloud services | Must always use MFA | Admin accounts must also be separate accounts used only for admin work |
| Accounts you own that your IT provider or MSP uses | Same rules as your own accounts: always on cloud services, and wherever available elsewhere | Accounts used by third parties, such as support services, are explicitly in scope |
| Other accounts reachable from the internet, such as VPNs, remote desktop gateways and hosted web apps | Must use MFA where it is available | The requirements say you should always use MFA on internet-accessible and admin accounts |
| Firewall or router admin interface reachable from the internet | Only with a documented business need, and then protected by MFA or by an IP allow list plus a properly managed password | Better still, keep the admin interface off the internet |
| Logging on to a laptop, desktop or phone | Not required | Device unlocking rules apply: biometric, password or PIN, brute-force protection, and at least 6 characters for a PIN or password used only to unlock |
Under v3.3 a cloud service is an on-demand, scalable service on shared infrastructure, reached over the internet through an account (credentials your organisation issues, or an email address used for business), that stores or processes your organisation’s data. That includes free tools staff sign up to with a work email address, which are easy to miss when you list your services. Cloud services cannot be excluded from scope.
Which factors count for Cyber Essentials MFA?
The requirements list four types of additional factor to use alongside a password. All four are acceptable; they differ in how well they resist phishing.
| Additional factor | Examples | How well it resists phishing |
|---|---|---|
| A managed or enterprise device | Sign-in allowed only from a company-managed laptop or phone that passes a device compliance check | Strong against stolen passwords, because they cannot be used from an unmanaged device |
| An app on a trusted device | Authenticator app codes, or push approvals with number matching | Good, but codes can be relayed through a fake sign-in page and push prompts approved by mistake |
| A physically separate token | A FIDO2 security key or a hardware code generator | FIDO2 keys are phishing-resistant; code generators are not |
| A known or trusted account | A code or sign-in link sent by SMS or email to a number or address already registered to the user | Usually the easiest to defeat, as codes can be intercepted or relayed |
The password used with MFA must be at least 8 characters, with no maximum length. Our Cyber Essentials password policy guide covers the rest of the password rules, including what applies to accounts without MFA.
The requirements also ask for factors that are usable and accessible, which may mean trialling options with staff first. The NCSC’s guidance on MFA for corporate online services explains the options in more depth.
Do SMS codes count as MFA for Cyber Essentials?
Yes. A one-time code sent by text message is accepted as MFA for Cyber Essentials. The v3.3 requirements say SMS is not the most secure type of MFA but still offers a huge advantage over having none, and recommend using alternatives instead where they will work for your situation.
The weaknesses are practical. A code can be relayed through a fake sign-in page, and attackers can take over a phone number through SIM swap fraud. SMS is fine as a fallback or for staff without a smartphone, but use something stronger where you can, especially for administrators: an authenticator app with number matching at minimum, and ideally FIDO2 security keys or passkeys.
Do passkeys and passwordless sign-in count as MFA?
Passkeys do. Version 3.3 updated its definition of passwordless authentication to include FIDO2: FIDO2 authenticators are considered passkeys and are regarded as MFA, because the user is verified as part of the sign-in, typically by fingerprint, face or device PIN, as well as by possession of the key. Passkeys are also phishing-resistant, because they only work on the website they were created for.
Passwordless authentication more generally is any method that proves identity with a factor other than knowledge, such as biometrics, security keys, push notifications or one-time codes. Only FIDO2 authenticators are expressly described as MFA, so if you use another passwordless method on a cloud service, check that it still involves two factors and ask your certification body if you are unsure.
Which MFA answers fail Cyber Essentials?
These gaps either fail the assessment outright, lead to a resubmission or leave MFA that an attacker can get around:
| Situation | Why it is a problem | Fix |
|---|---|---|
| MFA on Microsoft 365 or Google Workspace but not on the accounting, HR, CRM or file-sharing service | Every cloud service needs MFA, not just email | List every cloud service and check each one |
| MFA available on a paid tier you have not bought | IASME counts paid options as available | Upgrade, use single sign-on with MFA, or replace the service |
| MFA offered to users but not enforced | Anyone who has not registered can still sign in with a password alone | Enforce MFA by policy, not by invitation |
| Administrators or senior staff excluded from MFA policies | Admin accounts carry the highest risk | Include them, with stronger methods |
| Legacy sign-in methods left switched on, such as app passwords or basic authentication for email clients | They cannot prompt for MFA, so they bypass it | Block legacy authentication where the service allows it |
| One shared login for a team, tied to one person’s phone | Every user needs unique credentials | Give each person their own account |
If a cloud service genuinely offers no MFA on any plan, say so in your answers and make sure its passwords meet the password-based authentication rules. Single sign-on through an identity provider that enforces MFA, or a replacement service, is the safer long-term answer.
How does Cyber Essentials Plus test MFA?
Cyber Essentials Plus tests MFA by watching real sign-ins. Under test case 4 of the NCSC’s Cyber Essentials Plus Test Specification, users of the sampled devices sign in to every cloud service in scope, for user and administrator access, from an untrusted device or an incognito browser session. The test passes only if they are prompted for MFA before access is granted. Where several services share one sign-in service, such as Microsoft Entra ID or Google, it is run once for that sign-in service.
Two practical points follow. A service that offers MFA without enforcing it fails, because no prompt appears. And if your policies skip MFA for trusted locations or remembered devices, try an incognito sign-in from an unmanaged device before the audit to see what the assessor will see. Test case 5 is separate: it checks that a standard user account cannot run an administrative process without a separate administrator login. Our Cyber Essentials Plus requirements page explains the other tests and how devices are sampled.
How do you get MFA ready before your assessment?
- List every cloud service that holds or processes organisational data, including free tools signed up to with work email addresses and services your MSP manages, and note which sign-in service each one uses.
- Check what MFA each one offers, on your current plan and on higher tiers.
- Enforce MFA for every account, starting with administrators, and block legacy authentication where the service allows it.
- Move administrators to phishing-resistant methods such as FIDO2 keys or passkeys, and keep admin accounts separate from day-to-day accounts.
- Test it as an assessor would. Sign in to each service from an incognito window as a user and as an administrator, confirm the MFA prompt appears, and keep screenshots or enforcement reports as evidence.
If you run Microsoft 365, our guide to Cyber Essentials for Microsoft 365 maps security defaults and Conditional Access to these rules. MFA is one part of user access control, and the Cyber Essentials checklist covers the rest of that control and the other four.
Why Sovereign Secure?
Sovereign Secure is an IASME-licensed Cyber Essentials certification body that issues Cyber Essentials and Cyber Essentials Plus certificates, and we are ISO 27001 certified. Every Cyber Essentials certification package includes a pre-assessment check and a support call of up to an hour, so MFA gaps can be found before your answers are marked. Packages start at £320 + VAT.
Next step
Not sure every cloud service is covered? Our free Cyber Essentials readiness check takes about five minutes and flags the April 2026 automatic fails, including missing cloud MFA. When you are ready, send us your list of devices and cloud services through the Cyber Essentials scoping questionnaire. We will confirm your scope and recommend the right package, and you can ask about any service where you are unsure how MFA applies.
Free tools and services
- Readiness checkAnswer 20 questions for a readiness score and a fix list before you apply.Start the free check
- Cyber Essentials pricesPackages for every company size, from £320 + VAT.See CE prices
- Get a CE+ quoteTell us about your devices and cloud services for a Cyber Essentials Plus quote.Get a CE+ quote
Last reviewed October 2026 by the Sovereign Secure assessment team.
