Cyber Essentials MFA Requirements for Cloud Services

The requirement is broader than protecting privileged administrators. Organisations need to identify every in-scope cloud service and ensure that the people who authenticate to it use MFA, regardless of whether they have standard or administrative access.

This includes familiar platforms such as Microsoft 365 and Google Workspace, but it can also include accounting systems, customer relationship management platforms, file-sharing services, HR systems, code repositories, backup platforms and other services that store or process organisational data.

What the Cyber Essentials MFA requirement means

For Cyber Essentials, authentication to an in-scope cloud service must use MFA wherever the service makes it available. It is not enough to enable MFA only for global administrators, IT staff or other privileged users.

• Standard user accounts accessing cloud services need MFA.
• Administrator and other privileged cloud accounts need MFA.
• MFA must be used if it is free, included in the subscription or available as a paid option.
• Cloud services that store or process organisational data must be considered in scope.
• Services cannot simply be excluded because enabling MFA is inconvenient.

The current Cyber Essentials requirements published by the NCSC state that authentication to cloud services must always use MFA where it is available. IASME also confirms that failure to implement it for cloud services results in an automatic assessment failure.

What counts as a cloud service?

Cyber Essentials describes a cloud service as an on-demand, scalable service hosted on shared infrastructure and accessed through the internet. For assessment purposes, it is typically accessed using an account and stores or processes data for the organisation.

The definition reaches beyond infrastructure platforms such as AWS, Microsoft Azure and Google Cloud. Most organisations use a much wider collection of software-as-a-service products that must also be reviewed.

A service does not fall outside the requirement merely because it is used by only one department or purchased directly by an employee. Shadow IT is one of the reasons a cloud-service inventory is essential.

Which accounts require MFA?

Accepted authentication methods

MFA uses two or more independent factors. These may include something the user knows, something they possess or something inherent to them. Passwordless methods such as properly implemented passkeys can also satisfy the requirement because authentication combines possession of the authenticator with user verification.

The best method is one that the service supports, users can operate reliably and the organisation can recover securely. Where practical, favour phishing-resistant authentication such as passkeys or hardware security keys, particularly for privileged accounts.

How to prepare for assessment

1. Build a cloud-service inventory. Include centrally managed platforms and services purchased or used by individual teams.
2. Identify every account. Review normal users, administrators, guests, contractors, emergency accounts and dormant access.
3. Check whether MFA is available. Record whether it is included, free or requires a different subscription. A paid option still counts as available.
4. Enforce MFA. A policy that allows users to opt in is weaker than central enforcement. Confirm that unenrolled users cannot continue signing in with only a password.
5. Deal with legacy authentication. Disable older protocols and interfaces that can bypass the normal MFA process.
6. Separate administrator access. Give administrators distinct privileged accounts and use them only when elevated access is required.
7. Plan secure recovery. Protect backup methods and recovery codes. Test the process without creating an easy route around MFA.
8. Collect evidence. Keep policy settings, account reports and other evidence that shows MFA is enforced across the assessment scope.

If you are unsure whether your services and accounts meet the requirements, use the Cyber Essentials readiness assessment before submitting your certification application.

Common reasons organisations get this wrong

Protecting administrators but not normal users

This is the main misunderstanding. Administrator protection is essential, but it does not satisfy the cloud-service requirement on its own. Ordinary users also authenticate to the service and can expose organisational data if their credentials are stolen.

Enabling MFA without enforcing it

An MFA feature may be switched on while enrolment remains optional. Check the effective policy and test it with representative accounts.

Missing departmental cloud services

Finance, HR, sales and development teams may use different platforms. An inventory based only on services managed by IT is often incomplete.

Assuming paid MFA does not count as available

IASME explicitly states that the requirement applies whether MFA is free, included or offered as a paid option. Cost does not make an available control unavailable.

Leaving a bypass route

Legacy mail protocols, application passwords, poorly controlled recovery processes or excluded user groups may allow password-only access even when the main login screen uses MFA.

Frequently asked questions

Check the whole cloud estate

The practical task is not simply enabling MFA in Microsoft 365 and declaring the work complete. Certification requires a defensible view of the cloud services in scope, the people who access them and the controls that actually apply when they sign in.

Review normal users and administrators, close bypass routes, protect recovery methods and keep enough evidence to demonstrate that MFA is enforced. This strengthens the organisation as well as preparing it for assessment.