If your organisation is aiming for Cyber Essentials certification, it’s crucial to understand that all cloud services you use must meet the required security controls. Cloud platforms aren’t inherently secure, and assuming they are is a risky move. The responsibility for locking things down ultimately sits with you. 

While cloud providers build security into their services, they don’t do all the heavy lifting. Some controls will be handled by them, but others fall firmly in your lap. How much responsibility you bear depends on the type of cloud service you’re using, so understanding the differences is key. 

Understanding Cloud Services

Cloud services cover infrastructure, platforms, and software delivered over the internet by third-party providers. Unlike traditional setups where data sits on your own hardware, cloud services store it on remote machines managed by someone else – potentially anywhere in the world. That makes security a shared responsibility, and knowing who’s responsible for what is critical. 

Types of Cloud Services

Cloud services generally fall into three categories: 

• Software as a Service (SaaS) – Fully managed software applications you access through a browser. The provider handles security updates, infrastructure, and maintenance. Think Microsoft 365, Trello, or HubSpot. 

• Platform as a Service (PaaS) – A cloud-based environment for building, managing, and deploying applications. You get the tools, but you’re not managing the infrastructure. Examples include AWS Lambda and DigitalOcean’s App Platform. 

• Infrastructure as a Service (IaaS) – Virtual computing resources like servers, storage, and networking. You get more control, but also more security responsibility. Examples: Microsoft Azure and Amazon Web Services. 

Who is Responsible for Security?

Cloud providers offer security measures, but they’re not a set-it-and-forget-it solution. Your organisation is ultimately accountable for ensuring Cyber Essentials compliance. That means securing configurations, managing user access, keeping everything updated, and making sure malware protection is in place. 

Multi-Factor Authentication (MFA) and Compliance

MFA is one of the simplest yet most effective security controls available, and it should be enabled for all users and administrators where supported. If a service doesn’t offer native MFA but allows integration (e.g., SAML 2 authentication in Microsoft 365), take advantage of it. 

If a cloud service doesn’t support MFA at all, you’ll need to disclose this when completing your Cyber Essentials self-assessment. Your assessor will review these services to determine if any exceptions apply. 

Can You Pass Cyber Essentials Without MFA?

Technically, yes – but it comes at a cost. Not enforcing MFA will result in non-compliance marks, and while you can have up to two non-compliance marks and still pass, it’s not a great look. Also, you wouldn’t be able to achieve CE+ unless the service doesn’t offer MFA. Wherever possible, MFA should be implemented to strengthen your security posture.  

Achieving Cyber Essentials certification isn’t just about ticking boxes – it’s about taking ownership of your security in the cloud. Understanding your role in protecting cloud services is essential for compliance and resilience. By implementing the right controls – including MFA – you can keep your organisation’s data and systems safer from threats. 

For a free consultation on your cloud strategy contact us on 01748 905 002 or email info@evolvenorth.com.