Buyer guide
Cyber Essentials MFA Requirements 2026: Practical Guide
Practical rule
Review MFA for administrator accounts and internet-accessible business accounts against the current Cyber Essentials requirements, then prefer stronger phishing-resistant methods where your platforms support them.
Evidence to gather
- Identity-provider policy showing where MFA is enforced.
- Administrator-account policy and exception list.
- Recovery and break-glass arrangements that do not bypass normal control without governance.
- Evidence for services that cannot support the preferred factor.
Factor strength
Separate the scheme's minimum requirements from broader security best practice. NCSC MFA guidance recommends stronger methods such as FIDO2 where practical, but your certification preparation should always be anchored to the current Cyber Essentials requirements for your exact scope.