🔴 New Auto-Fail
MFA on cloud services — if MFA is available on any cloud platform and you haven't enabled it, assessment fails immediately. Cost is not an excuse.
🔴 New Auto-Fail
14-day patching (A6.4 & A6.5) — missing the window for OS/firmware or application fixes is now immediate failure. Previous tolerance removed.
⚠️ Changed
Password minimum → 12 characters (up from 8). MFA or passwordless authentication satisfies this independently.
⚠️ Changed
Point-in-time = certificate issue date — your systems must be compliant on the day the certificate is issued, not submission day.
✦ Clarified
Passkeys are now the NCSC's preferred auth method. FIDO2, biometrics, OTPs, security keys and push notifications all formally accepted.
✦ Clarified
Cloud services formally defined for the first time — they cannot be excluded from scope. Scope descriptions are now unlimited in length on certificates.
✦ Clarified
Director declaration updated — now includes explicit acknowledgement of responsibility for maintaining CE compliance throughout the full certification period.
⚠️ CE+ Only
Self-assessment locked before CE+ audit — VSA responses cannot be amended after testing begins. "Selective patching" workaround closed.