Does SMS MFA count for Cyber Essentials?

Yes. SMS MFA counts for Cyber Essentials. The current requirements, version 3.3 from April 2026, accept a code sent by text message as multi-factor authentication. The same document says text codes aren’t the most secure choice and recommends something else where it will work for you.

So you won’t fail for using text codes. You can still do better, and for Microsoft 365 you’ll soon have to.

What the requirements say

The wording comes from the NCSC’s Requirements for IT Infrastructure, the document assessors mark you against:

“SMS is not the most secure type of MFA but still offers a huge advantage over not using any MFA at all.”

It goes on to say that if alternatives are available that will work for your situation, you should use those instead of SMS. That’s a recommendation. Text codes meet the requirement as it stands.

Where you need MFA

The type of MFA matters less than where it’s switched on. The requirements say authentication to cloud services “must always use MFA”, and version 3.3 makes clear that cloud services can’t be left out of scope. In practice that means:

• Every cloud service your business uses, for every user: email, file storage, accounts, payroll, CRM
• Administrator accounts
• Any account that can be reached from the internet

A cloud service with no MFA at all is the thing to fix before you apply. One protected by text codes meets the rule.

Why it’s worth moving on anyway

Text codes can be intercepted if a criminal persuades a mobile network to move your number to their SIM, and a code can be read out to a convincing caller or typed into a fake sign-in page. An authenticator app closes some of those gaps. A passkey or a security key closes more of them, because there’s no code to hand over.

There’s also a deadline. Microsoft is retiring the text and voice codes it provides for Microsoft 365 sign-ins from 1 February 2027. Our story on the Microsoft 365 change explains what your team will see.

What to use instead

Method	Good for
Passkey (fingerprint, face or PIN on your device)	Most people, most of the time. Nothing to type and very hard to phish.
Authenticator app	Services that don’t offer passkeys yet.
Hardware security key	Administrators, and anyone who can’t use a phone at work.
Text message code	A fallback where nothing else is offered. Much better than a password alone.

Our MFA guide shows how to switch each one on, and fromIT’s Cyber Essentials help checks it across every service before you apply.

FAQ

Will text codes stop counting for Cyber Essentials?

Not under the current requirements. The scheme is updated from time to time, so check the version in force when you apply. The direction from the NCSC is clear enough that it makes sense to move now.

Do we need MFA on every cloud service?

Yes. The requirements say authentication to cloud services must always use MFA, and that covers ordinary users as well as administrators.

Is an authenticator app enough?

Yes. An app on a trusted device is one of the types of extra factor the requirements describe, and it’s a step up from text codes.

Source

• NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3 (April 2026), user access control section