Cyber Essentials and ISO 27001: The People Behind Your Certificate

The 2026 Cyber Essentials update makes two everyday IT tasks automatic fails: missing MFA on any cloud service that offers it, and critical updates left for more than 14 days. It applies to assessment accounts created after 26 April 2026 (Requirements v3.3 and the Danzell question set). 

The five technical controls haven't changed, and there's still no staff training control. But each change lands on someone specific:

What changed	Who it lands on	Training that helps
MFA on every cloud service (automatic fail)	IT admins	Microsoft certifications covering identity and access
Critical updates within 14 days (automatic fail)	Infrastructure team	IT service management training for patch and change planning
Cloud services can't be left out of scope	Cloud admins	Cloud corporate training or AWS training

If the person behind any row is new or about to leave, your next assessment is at risk, therefore we'd suggest naming a deputy for each before your renewal date.

What Does ISO 27001 Say About Staff Training and Competence?

ISO 27001:2022 requires competence in every role that affects information security (clause 7.2) and security awareness for all staff (clause 7.3). Annex A control 6.3 covers awareness, education and training. 

Clause 7.2 asks you to define what each role needs, close any gaps, check that the training worked and keep evidence. That third step is the one teams skip most. A completion log shows who finished a module, so pair it with a before-and-after knowledge check or a certification with a pass date your auditor can see.

What Training Supports Cyber Essentials and ISO 27001?

Awareness training for all staff supports ISO 27001 clause 7.3, while certifications give your security team dated evidence for clause 7.2.
The awareness gap is wide. The UK Government's Cyber Security Breaches Survey 2025/26 found phishing was involved in 93% of attacks on businesses that identified one. Yet fewer than one in five businesses (19%) trained staff on cybersecurity. 

Our awareness training, part of our wider compliance training, shows staff how to spot a fake invoice or login page, with a knowledge check before and after. Reporting through our learning platform gives your auditor the record and your managers a view of who's behind. 

For your security team, our CompTIA certifications for teams are a good fit:

• CompTIA Security+ for core security knowledge
• CompTIA CySA+ for threat detection and incident response
• EC-Council's Certified Ethical Hacker (CEH) for whoever tests your defences

If you're FCA-regulated, the same records support your operational resilience self-assessment. Our FCA operational resilience checklist covers that side.

We train the people, and certification stays with the certification bodies: IASME-licensed bodies for Cyber Essentials, and UKAS-accredited bodies for ISO 27001.

Get Your People Ready for Your Next Cyber Essentials or ISO 27001 Audit

Your next renewal or ISO 27001 surveillance audit (the yearly check between full recertifications) is when the people evidence gets tested. We'll benchmark your team's skills against the controls they run, then build a training plan around the gaps.

If you'd like to know which roles carry your controls today, book a free consultation and we'll talk it through.