Cyber Essentials and free SaaS tools: does MFA apply to Trello, Canva and Slack?

Yes. If a free or personal-tier tool holds company or customer data, it counts as an in-scope cloud service under the current Cyber Essentials rules, whether or not IT ever formally approved it. That means multi-factor authentication (MFA) needs to be switched on for every account, admin and standard user alike, on every tool that supports it.

If a free or personal-tier tool holds company or customer data, it counts as an in-scope cloud service under the current Cyber Essentials rules.

This is one of the most common reasons businesses fail an assessment they thought they'd pass: someone on the team is using a free Trello board or personal Dropbox for work, MFA was never turned on, and nobody thought to check because it "wasn't a work system."

The fix is usually quick once you know where to look: list every free tool anyone actually uses for company data, and check MFA is on for each one. Run the free 5-minute readiness check to see if this affects you.