In short: Cyber Essentials MFA rules tightened on 27 April 2026 with Requirements v3.3 and the Danzell question set: authentication to cloud services must always use MFA, and leaving available MFA switched off is an automatic fail. Cisco Duo adds MFA to cloud apps, administrator accounts, VPNs and remote desktop, and its device checks support patching.
What Cyber Essentials v3.3 says about MFA
The NCSC's *Requirements for IT Infrastructure v3.3*, published in April 2026, keeps MFA under the User Access Control control. In plain terms, your organisation must:
- Use MFA wherever it is available, and always use it for authentication to cloud services
- Use MFA on administrative accounts and on accounts that can be reached from the internet
- Keep cloud services in scope: v3.3 states plainly that cloud services cannot be excluded
- Protect the password element: where MFA includes a password, it must be at least 8 characters with no maximum length
- Protect internet-facing firewall admin interfaces with MFA, or with an IP allow list plus properly managed passwords
IASME, which delivers the scheme for the NCSC, has been clearer still. MFA is mandatory for every cloud service that offers it, and an applicant that has not switched it on, whether the MFA is free, included or a paid extra, now fails the assessment automatically. v3.3 and the Danzell question set apply to assessment accounts created from 27 April 2026.
v3.3 also updated its definition of passwordless authentication: FIDO2 authenticators are treated as passkeys and are regarded as MFA. We do not re-explain the whole scheme here: our sister site covers the Cyber Essentials requirements in full, including the user access control control.
Where Cisco Duo closes the gaps
Most organisations fail on MFA through gaps, not through having no MFA at all: a SaaS tool someone signed up to, a shared admin login, a firewall portal, a VPN still using passwords. Duo is useful because one product and one app cover all of them.
| Gap | How Duo closes it |
|---|---|
| Microsoft 365 and Entra ID | Microsoft has its own MFA. Duo can be the MFA method instead, through Microsoft Entra ID: External MFA (each user signing in with Duo needs an Entra ID P1 or P2 licence) or Duo SSO federation, so staff use one method everywhere |
| SaaS apps with weak, paid or no MFA | Put the app behind Duo Single Sign-On using SAML or OIDC, so every login goes through Duo |
| Google Workspace | Duo SSO as the SAML identity provider: see Duo for Google Workspace |
| Remote access VPN | SAML through Duo SSO, or RADIUS through the Duo Authentication Proxy: see Duo VPN MFA |
| Remote desktop | Windows Logon and RDP on the host, or the RD Gateway plugin |
| Administrator accounts | Separate admin accounts, with Duo on admin portals through SSO, on Windows servers through Windows Logon, and on Linux SSH through Duo Unix |
| Firewall management interface | Where the management login supports RADIUS or SAML, put Duo in front of it through the Authentication Proxy or Duo SSO; otherwise use the firewall's own MFA, or an IP allow list with a properly managed password |
Duo Single Sign-On, and so every SSO route above, is included from Duo Essentials. Duo Free covers MFA for up to 10 users with a narrower feature set, so check it covers the applications you need before relying on it.
One caution. If you put a cloud service behind Duo SSO, make sure users cannot still sign in directly with a local username and password, or that route is a login without MFA. Turn off local logins where the service allows it, and ask your certification body if you are unsure how they will view your set-up. Where a service offers good native MFA and cannot be federated, simply switch the native MFA on.
Choosing factors that pass and that people will use
Cyber Essentials lists four types of additional factor: a managed or enterprise device, an app on a trusted device, a physically separate token, and a known or trusted account. Duo's methods line up with these:
- An app on a trusted device: Duo Push and Verified Duo Push in Duo Mobile, or passcodes from the app
- A physically separate token: hardware tokens and FIDO2 security keys, ideal for staff without a smartphone
- Passkeys and platform authenticators such as Windows Hello and Touch ID, which v3.3 treats as MFA; see Duo passwordless
- SMS and phone callback: still allowed, and better than no MFA, but the requirements recommend stronger options where they work for you. Duo's authentication methods policy, available from Duo Essentials, can switch them off
The requirements also note that additional factors should be usable and accessible, so plan for staff with accessibility needs and people without work phones before you enforce anything.
A useful scope point: phones used only for native voice, native text and MFA apps are out of scope. A personal phone that runs nothing work-related except Duo Mobile does not bring that phone into your assessment. If the same phone also opens work email, it is in scope.
Device trust and security update management
Cyber Essentials requires in-scope software to be licensed and supported, unsupported software to be removed, automatic updates to be enabled where possible, and critical or high-risk updates (including those with a CVSS v3 base score of 7 or above) to be installed within 14 days of release. Duo does not patch devices, but it can stop unpatched or unknown devices reaching your data:
- Trusted Endpoints (from Duo Essentials) checks that a device is managed through Intune, Jamf or another tool, or registered through Duo Desktop, before it reaches sensitive apps
- Device health checks (from Duo Advantage) use Duo Desktop to block devices whose firewall, disk encryption (BitLocker or FileVault) or system password is switched off
- Operating system and browser policies (from Advantage) can block operating system and browser versions that are out of date
Used together with a patching process, these policies help make sure only supported, up-to-date devices are used for organisational data. See Cisco Duo device trust for the checks in each edition.
Evidence for your assessment
The Cyber Essentials questionnaire asks what you have in place, and Cyber Essentials Plus adds hands-on technical testing. The Duo Admin Panel gives you most of what you need to answer with confidence:
- The list of protected applications, which doubles as your cloud services inventory for MFA
- Users and their enrolment status, so you can spot anyone who has never enrolled
- Policies showing which methods are allowed and where MFA is required
- The authentication log, showing that logins really did use a second factor
In Duo Advantage and Premier, Cisco Identity Intelligence also looks across Duo and your other identity systems for accounts with no MFA or only weak methods, which is a quick way to find the gaps an assessor would.
How we help
We start with a short MFA gap review: we list your cloud services, check which offer MFA and which can be federated, and look at admin accounts, firewalls and remote access. Then we decide service by service whether native MFA or Duo is the better answer, roll Duo out where it fits, and give you the evidence to answer the questionnaire.
Forever Systems also helps organisations through certification on Cyber Essentials UK. Contact us to book a gap review or ask for a quote.
How Forever Systems supplies and supports Cisco Duo
We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.
- Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
- Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
- Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
- Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
- Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Duo quote, trial or roll-out plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is MFA mandatory for Cyber Essentials?
Yes, wherever it is available. Under Requirements v3.3, authentication to cloud services must always use MFA, and IASME says an organisation that has not enabled MFA on a cloud service that offers it, whether free, included or paid, will automatically fail. MFA should also be used on administrative accounts and accounts reachable from the internet.
Does Cisco Duo count as MFA for Cyber Essentials?
Duo provides genuine multi-factor authentication: a password or passkey plus an app on a trusted device, a hardware token or a security key. It matches the types of additional factor the requirements list, provided every login to the service actually goes through Duo. Your certification body makes the final judgement on your set-up.
Do we have to pay for MFA if a cloud service charges extra for it?
IASME's guidance is that MFA is mandatory for cloud services where it is available, whether it is free, included or a paid option. If paying for a service's own MFA is unattractive, check whether the service supports SAML or OIDC single sign-on, because putting it behind Duo SSO may be an alternative.
Is SMS acceptable as MFA for Cyber Essentials?
Yes. The requirements say SMS is not the most secure type of MFA but is far better than none. They recommend stronger alternatives where they suit you, such as an authenticator app, a hardware token or a passkey.
Is a personal phone with Duo Mobile in scope for Cyber Essentials?
Not if it is used only for native voice, native text and MFA apps. Those devices are out of scope. If staff also use the phone for work email or other organisational data, it comes into scope.
Which Duo edition do we need for Cyber Essentials?
It depends on what needs covering. Duo Free covers up to 10 users with MFA. Duo Essentials adds single sign-on for SaaS apps, passwordless, Trusted Endpoints and control over which authentication methods are allowed, and is the usual choice. Duo Advantage adds device health checks and operating system policies that support security update management. Ask us for a quote.