April 30, 2025
What Changed in Cyber Essentials Requirements in 2025?
How to review scope, cloud services, devices and evidence when Cyber Essentials requirements change.
Use the current requirements
Cyber Essentials technical requirements are reviewed regularly. Applications started from 28 April 2025 used version 3.2, so organisations needed to work from the question set and requirements that applied to their assessment.
Check scope before controls
Document devices, cloud services, users, networks and boundary protections. A clear scope makes technical remediation and evidence collection more reliable.
Treat certification as a baseline
The five control themes provide a useful foundation, but risk management, backup, monitoring, response and staff behaviour still require ongoing attention.