Is multi-factor authentication (MFA) switched on for every admin account on your cloud services (e.g. Microsoft 365, Google Workspace)?

Under the current Cyber Essentials rules (v3.3, in force since April 2026), missing MFA on any admin account for an in-scope cloud service is an automatic fail. There's no partial credit.