Cyber Essentials Changes in 2026 – Cloud Services
This year’s update to Cyber Essentials represents one of the most significant overhauls of the scheme since its introduction. With the update in effect from April 2026, it is essential that organisations seeking or maintaining certification understand these changes and their practical impact.
In this short video, we explain the new formal definition of a ‘cloud service’ that IASME has provided this year. Our expert breaks down the practical impact of this new definition, and the checks assessors will be performing to confirm compliance with cloud service requirements.
URM is a licensed Cyber Essentials certification body and an accredited Assured Service Provider under the NCSC Cyber Advisor scheme. We can provide practical, cost-effective advice to improve your cyber security and achieve Cyber Essentials and Cyber Essentials Plus certifications.
Contact sales@urmconsulting.com to book a free call with a cyber security expert.
Contact the InfoSec Experts Today
Having assisted over 450 organisations to implement an ISMS and then achieve ISO 27001 certification since the Standard was first published in 2005, we at URM are the ideal partners to help you certify. With our fully-tailored approach, our specialists can support you through each stage of the ISO 27001 management system lifecycle, offering guidance specific to your organisation’s unique requirements.
Get in touch with our information security experts today to find out more.
InfoSec Solutions & Products
One the key requirements of ISO 27001 is the need for a robust risk assessment process which can produce repeatable and comparable results. With its proven, best practice methodology, URM’s information security risk management software, Abriska 27001, enables you to meet this requirement. We can also assist you to raise and maintain awareness among your staff with our expertly designed and engaging learning management system (LMS), Alurna.
InfoSec Training Courses
Our information security and risk management training courses can help you learn how to effectively manage information security. Our Certificate in Information Security Management Principles (CISMP) and Practitioner Certificate in Information Risk Management (PCIRM) training courses will prepare you to take the BCS (Chartered Institute for IT) administered exams, enabling you to gain industry-recognised qualifications.
Webinars & Events
URM has gained a reputation as the preeminent UK provider of live webinars, aimed at delivering valuable and practical insights to organisations looking to improve their information security, risk management, data protection etc. The webinars are delivered by our senior consultants who share hints and tips on topics such as certifying to ISO 27001 and Cyber Essentials, complying with the GDPR. All of our webinars are completely free to attend, and include an opportunity to ask questions at the end.
The impact of STAIRs is expected to be highly significant. This session will set out the practical steps PRPs can take now to get ready for new Requirements.
URM highlights five essential risk management ‘must dos’ that organisations use to strengthen performance and resilience.
Learn how to achieve ISO 27001 certification with guidance from URM and BSI. Understand key steps, benefits, and pitfalls in implementing an effective ISMS.
Information Security FAQs
What are 4 types of information security?
If we look to guidance from Annex A of ISO 27001, then the answer is organisational, people, physical and technological. The International Standard groups information security into these 4 categories. The ‘organisational’ category requires the creation of policies, roles and responsibilities and day-to-day business activities. The ‘people’ category ensures that the most appropriate staff are employed, and that they understand what is expected of them in relation to the business’ approach to infosec. ‘Physical’ controls relate to the security of business premises, clear desk policies etc, whilst, ‘technological’ controls relate to measures that may be adopted by organisations to assist in securing information through the use of technology such as capacity management, configuration management, change management, network security, firewalls, cryptography etc.
What are the 3 principles of information security?
The three aspects that information security (infosec) seeks to protect are ‘confidentiality’, ‘integrity’ and ‘availability’. Confidentiality ensures that information is not made available or disclosed to unauthorised entities. Integrity protects the accuracy and completeness of assets, whilst Availability ensures that information is accessible and usable on demand by authorised individuals.tc.
What are information security examples?
Examples of information security include encryption, firewalls, antivirus software, multi-factor authentication (MFA), vetting of individuals, controlling access to premises / information and providing staff awareness training.
What are 5 information security policies?
Policies provide direction on your organisation’s approach to different aspects of information security management. Policies may relate to the classification of data, password management, acceptable use of assets, authentication procedures and incident response - these are five examples, but your organisation may choose to formulate a policy relating to any aspect of information security (infosec) management.
ISO 27001 Clause 10.2: Nonconformity and corrective action
URM’s blog explains how to meet ISO 27001 Clause 10.2, including finding nonconformities, performing root cause analysis, implementing corrective actions & more
URM’s blog breaks down how to effectively implement ISO 42001, where it differs from other ISO standards, and the common certification pitfalls to avoid
URM’s blog outlines practical tips for a successful ISO 27001 implementation, and the common mistakes to avoid throughout the certification process.
URM’s blog breaks down ISO 27001 Clause 7.5 requirements, with practical guidance on how to achieve conformance to this Clause & what external assessors expect.