Under Cyber Essentials v3.3 (April 2026), FIDO2 authenticators, which include platform and hardware passkeys, are regarded as multi-factor authentication because user verification is performed as part of the sign-in. A passkey on its own therefore satisfies the MFA requirement for cloud services in A7.16 and A7.17. Where a password remains as a fallback, it must be at least 8 characters.
Key takeaways
- NCSC Requirements v3.3 states that FIDO2 authenticators are regarded as MFA because user authentication is performed, so a passkey alone satisfies A7.16 and A7.17.
- A fallback password on a passkey account must still be at least 8 characters, and the A7.10 brute-force protections still apply to it under v3.3.
- SMS codes still count as MFA: v3.3 says SMS "is not the most secure type of MFA but still offers a huge advantage over not using any MFA at all".
- Two knowledge factors, such as a password and a security question, are one factor and do not meet the MFA requirement in v3.3.
- Rule in v3.3
- FIDO2 authenticators, which include passkeys, are regarded as MFA because user authentication is performed
- Fallback password
- At least 8 characters, no maximum length, and protected from brute force under A7.10
- Still counts as MFA
- Authenticator app, push notification, hardware key, SMS code
- Does not count
- Two knowledge factors together, or a device PIN that only unlocks the device
- Questions
- A4.3, A5.5 (option D passwordless), A7.10, A7.14, A7.16, A7.17
- CE Plus check
- Test case 4: a user and an admin sign in to each cloud service from a fresh session
Requirements for IT Infrastructure v3.3 went live with the Danzell question set on 27 April 2026. Its "what's new" list is six lines long, and one of them settles a question applicants often ask: "Updated definition for Passwordless Authentication to include FIDO2". IASME's own summary of the April 2026 changes adds that the NCSC would like to see passkeys become the default authentication recommendation.
What does v3.3 actually say?
The definitions section now reads: "Passwordless authentication is a method to establish a user's identity that uses a factor other than knowledge. Examples include but are not limited to: FIDO2 authenticators, biometric data, security keys or tokens, one-time codes, QR codes, and push notifications."
The user access control section goes further on passkeys specifically. It describes them as passwordless login based on public-key cryptography, states that "this includes FIDO2 authenticators which are considered as Passkeys", and then the sentence that matters: "FIDO2 authenticators are regarded as MFA because user authentication is performed."
That is the scheme saying a passkey is a second factor in its own right. The possession factor is the private key on the device; the verification factor is the biometric or PIN that releases it.
Which questions does this change?
| Question | Before | Under v3.3 |
|---|---|---|
| A7.16AUTO-FAIL MFA for cloud administrators | Password plus a separate factor | Passkey alone satisfies MFA; a fallback password must be 8 characters or more |
| A7.17AUTO-FAIL MFA for cloud users | Same | Same |
| A4.3 firewall password configuration | Options A to C plus "none" | Option D is passwordless and needs a notes-field description |
| A7.10 brute-force protection | Applies to passwords | Also applies where "passwords are a backup for a passwordless system" |
The A7.10 wording is the one to read twice. Going passwordless does not remove the password from scope if it still exists as a fallback. Most identity providers keep one. It needs throttling, account lockout after no more than 10 attempts, or MFA in front of it, and it needs the 8-character minimum that the MFA section sets for "the password element of the multi-factor authentication approach".
"No more than 10 guesses in 5 minutes" is the throttling threshold and "no more than 10 unsuccessful attempts" the lockout threshold. Both are quoted from the password-based authentication section of v3.3.
What still does not count as MFA?
The requirements list four types of additional factor: a managed or enterprise device, an app on a trusted device, a physically separate token, and a known or trusted account. Anything that is a second knowledge factor is not on the list. Security questions, a second password and a memorable word are all knowledge; two of them together are one factor.
A device PIN that only unlocks the laptop is not MFA for the cloud service either. It is the device unlocking credential from the secure configuration section, with its own 6-character minimum. The cloud sign-in has to prompt for its own second factor, or use a passkey that performs user verification.
Cyber Essentials Plus test case 4 has the assessor watch a user and an administrator sign in to each cloud service from an untrusted device or an incognito session. A passkey prompt that asks for Touch ID or a PIN is a pass. A saved session that opens straight to the inbox is a fail, whatever the tenant policy says.
How should you answer the questions if you have moved to passkeys?
A7.14 asks whether all cloud services offer MFA. Answer per service, not per identity provider: Microsoft 365 and Google Workspace support passkeys, but the accounts package or the CRM may only offer TOTP or SMS. Those still count; they need enabling.
For A7.16 and A7.17, answer yes only when every administrator and every user is enrolled. A tenant where passkeys are "available" but half the users still sign in with a password and no second factor fails both questions.
Passkeys rolled out to staff, with the break-glass Global Administrator accounts deliberately left on password only "so we can always get in". A7.16 says all administrators. Protect emergency accounts with a hardware security key kept in a safe, and the question is answered.
Where to read the full requirement
The Microsoft 365 and Entra ID and Google Workspace setup guides cover enforcing MFA across a tenant. The user access control hub sets out A7.1 to A7.17 with the v3.3 wording for passwords, MFA and passwordless side by side. The 2026 change log lists the other five changes in v3.3. If you are part-way through a passkey rollout and want to know whether the fallback configuration passes, the readiness checker covers A7.10 and A7.16 in its user access control step, and a gap analysis will check the tenant with you.
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026 (v16.3)Read on iasme.co.uk (opens in a new tab)
- NCSCNCSC, Multi-factor authentication for your corporate online servicesRead on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Upcoming changes to the Cyber Essentials scheme: April 2026 updateRead on iasme.co.uk (opens in a new tab)
Frequently asked questions
The requirements say FIDO2 authenticators are regarded as MFA because user authentication is performed. Synced platform passkeys are FIDO2 credentials and unlock with the device's biometric or PIN. We accept them as MFA for A7.16 and A7.17. Keep the account's fallback password at 8 characters or more.
Yes. The requirements state that SMS is not the most secure type of MFA but still offers a huge advantage over none, and recommend alternatives where they will work. An SMS code is a second factor for the purposes of A7.16 and A7.17.
The 12-character minimum is one of three options for managing password quality; MFA is another. If every account is protected by MFA, including a passkey, the 12-character rule is not required. The password element of an MFA sign-in must still be at least 8 characters.
v3.3 lists 'Updated definition for Passwordless Authentication to include FIDO2' among its changes. The definition now names FIDO2 authenticators, biometric data, security keys or tokens, one-time codes, QR codes and push notifications, and the user access control section states that FIDO2 authenticators are regarded as MFA.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh