Skip to content
Made in the UK

Cyber Essentials

How do you stay Cyber Essentials compliant all year, not just at renewal?

By , CEO, CybaVerse. Last reviewed

You stay Cyber Essentials compliant all year by monitoring the five controls continuously: an accurate asset inventory, daily checks for missing critical updates, MFA and admin account reviews, and tracking every gap to closure with evidence. Organisations now declare they will maintain compliance throughout certification.

This page is part of our Cyber Essentials guide for MSPs.

Why does year-round Cyber Essentials compliance matter now?

Recent scheme changes made MFA and 14-day updates auto-fail questions, added a CE+ resample that includes new devices, and made organisations declare they will maintain compliance through the certification period. A renewal-week scramble now risks failure or revocation, so continuous monitoring is the safer model.

Cyber Essentials covers five controls: firewalls, secure configuration, security update management, user access control and malware protection. Recent changes have raised the stakes:

  • Questions on MFA for cloud services and on 14-day security updates are now auto-fail questions, according to IASME.
  • In Cyber Essentials Plus, if the initial sample fails update management, the retest checks the original sample plus a new random sample. A second failure can lead to the certificate being revoked.
  • The declaration makes organisations responsible for maintaining compliance across the certification period.

Partners also tell us that renewals cluster at certain times of year, assessor slots get tight and clients leave critical software updates to the last minute. Continuous compliance removes that pressure.

How do you stay Cyber Essentials compliant all year, step by step?

These eight steps keep each client ready between assessments. They cover inventory, daily update checks, MFA and admin reviews, malware protection, secure configuration, firewall reviews, a mock assessment before renewal and continuous evidence, so certification becomes a formality instead of a project.

  1. Step 1: Keep an accurate inventory of in-scope assets

    List devices, users, cloud services, firewalls and routers. Update it automatically from your directory and agents rather than by hand.

  2. Step 2: Check security updates daily

    Scan for missing fixes that are critical, high risk or CVSS 7 and above, and track each against the 14-day window from vendor release.

  3. Step 3: Monitor MFA and admin accounts

    Flag any user without MFA on cloud services, and review admin accounts monthly. These are among the quickest auto-fails to prevent.

  4. Step 4: Confirm malware protection is present and current

    Check every device has active, up-to-date anti-malware or EDR, and that devices without your agent are visible.

  5. Step 5: Review secure configuration

    Look for default passwords, unnecessary accounts and software, and weak Microsoft 365 settings.

  6. Step 6: Review firewall and router configuration quarterly

    Confirm default admin passwords are changed and inbound rules are documented and justified.

  7. Step 7: Run a mock assessment before renewal

    Two to three months before renewal, run a vulnerability scan and walk through the questionnaire to find gaps while there is time to fix them.

  8. Step 8: Keep evidence continuously

    Store reports showing patch status, MFA coverage and remediation over time so the assessment becomes a formality.

How does CybaVerse help with Cyber Essentials?

CybaVerse delivers Cyber Essentials and Cyber Essentials Plus certification through MSPs as a service, and CybaOps vulnerability scanning helps clients find and fix failures throughout the year. Treating certification as part of an ongoing security service means gaps are caught early, not weeks before the assessor arrives.

  • CybaVerse delivers Cyber Essentials and Cyber Essentials Plus certification, run through the CybaOps platform.
  • Cyber Essentials Plus works best as part of an ongoing security service, not a once-a-year exam.
  • CybaOps vulnerability scanning helps you find and fix CE+ failures before the assessment.
  • Internal scans run several times a day and external scans run daily.
  • CybaVerse holds Cyber Essentials and Cyber Essentials Plus itself.
  • We are adding Microsoft 365 configuration checks to CybaOps vulnerability management.

Cyber Essentials all year

How to stay CE compliant all year, not just renewal

You stay Cyber Essentials compliant all year by monitoring the five controls continuously: an accurate asset inventory, daily checks for missing critical updates, MFA and admin account reviews, and tracking every gap to closure with evidence.

01 Readiness checks

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

Cyber Essentials all year

02 The 8-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • Delivered with
  • Cyber Essentials & CE+
  • CybaVM

What else do teams ask about staying Cyber Essentials compliant?

These are the questions MSPs and IT managers ask most about keeping Cyber Essentials between renewals.

How often should we check Cyber Essentials controls?

Updates and vulnerabilities daily, MFA and accounts at least monthly, firewall configuration quarterly, with a mock assessment before renewal. A regular rhythm like this keeps clients compliant all year, rather than relying on a rush of fixes in the weeks before the assessment.

What fails Cyber Essentials most often?

Missing critical or high-risk updates beyond 14 days and cloud services without MFA, both now auto-fail questions. Checking update status and MFA coverage across every client on a regular schedule is the simplest way to catch these issues well before an assessment.

Do we need CE before CE+?

Yes. CE+ builds on the CE self-assessment. The self-assessment sets out how the five controls are met, and CE+ then tests those controls technically. Getting the CE answers accurate and evidenced first makes the CE+ assessment far more straightforward.

Can we fix issues found in the CE+ scan and still pass?

Check the current IASME rules with your certification body. Under the April 2026 rules a failed sample triggers a retest that adds a new random sample, so fix across the whole estate, not just the devices you expect to be tested.

Is Cyber Essentials enough on its own?

It covers the basics. Use a wider assessment such as the NCSC 10 Steps to measure overall posture. Cyber Essentials is a strong baseline against common attacks, but most organisations also benefit from continuous monitoring and a broader view of their risk.

What should you do next?

See Cyber Essentials and vulnerability scanning on the CybaOps Platform page. MSPs delivering CE to clients can read more on the Partner page.

Related: How do MSPs meet the 14-day remediation rule across every client? and Why do clients fail Cyber Essentials Plus on software updates, and how do MSPs fix it?

See how CybaOps vulnerability scanning supports Cyber Essentials preparation.

Book a CybaOps demo