Clarifying MFA Requirements and Paid Option Implications in Upcoming Cyber Essentials Changes

·Apr 20, 2026 11:46 AM·

Hi all, quick question on the upcoming Cyber Essentials changes, specifically around MFA 🔐 I understand MFA is already required, but the updated wording seems stricter:

“Where MFA is available for a cloud service whether free, included, via integration, or offered as a paid option, and MFA is not implemented, this would result in an automatic failure.”

I’m trying to clarify what “offered as a paid option” really means in practice. Does this imply organisations are expected to upgrade to higher-tier plans purely to enable MFA? In a lot of cases, MFA isn’t included in standard plans and requires a fairly significant cost jump to access it. It would be useful to understand whether that scenario is now effectively mandatory under CE. Appreciate any insight from anyone who’s looked into this, thanks!

4 comments

· Sorted by Oldest

Vanta Community
APP
·
·
This post is now synced! Check it out here:
Clarifying MFA Requirements and Paid Option Implications in Upcoming Cyber Essentials Changes
⤵️ Any future comments will be automatically posted to the thread
Jason L.
·
·
Ffion, your reading of the update seems accurate. If a vendor offers MFA at all, even if it costs a lot of extra money, it is mandatory. This means that anyone looking to meet the CE criteria should be comparing vendors' pricing tiers no lower than the one in which MFA is included. Additionally, I recommend avoiding vendors who hide MFA behind a paywall, in general, since they are demonstrating how little they value your security and how willing they are to harm their customers to make money.
2
1
1
Ffion
·
·
Thank you Jason L. 💡
Kareem M.
·
·
I second Jason's reading of this. If there's a breach regulators will want to make sure all necessary controls were implemented to prevent a breach. This can also have cyber insurance implications as well. To put it another way, this is like expecting your bank to invest in the latest and greatest in Vault technology even if its expensive.

Clarifying MFA Requirements and Paid Option Implications in Upcoming Cyber Essentials Changes | Vanta Community