Cyber Essentials and free SaaS tools: does MFA apply to Trello, Canva and Slack?

Yes. If a free or personal-tier tool holds company or customer data, it counts as an in-scope cloud service under the current Cyber Essentials rules, whether or not IT ever formally approved it. That means multi-factor authentication (MFA) needs to be switched on for every account, admin and standard user alike, on every tool that supports it.

This is one of the most common reasons businesses fail an assessment they thought they'd pass: someone on the team is using a free Trello board or personal Dropbox for work, MFA was never turned on, and nobody thought to check because it "wasn't a work system."

The fix is usually quick once you know where to look: list every free tool anyone actually uses for company data, and check MFA is on for each one. Run the free 5-minute readiness check to see if this affects you.