Cyber Essentials now makes cloud MFA a formal pass requirement. The April 2026 update also puts critical patching, cloud scoping, remote devices, and supplier assurance under closer assessment, leaving less room for cyber hygiene to be treated as annual paperwork.