Cyber Essentials under the Danzell question set: what changed in 2026 and how to pass first time

If your Cyber Essentials certificate is coming up for renewal, or you’re going for it for the first time, the questions you’ll answer are not the ones you answered last year. In April 2026 the scheme moved to a new question set called Danzell, built on the NCSC’s updated Requirements for IT Infrastructure v3.3. Most of the controls are familiar, but the marking is stricter in a few places that catch out small businesses.

This guide covers what actually changed, the questions that now fail you outright, and the preparation that gets a pass first time.

When Danzell came in

IASME, the NCSC’s official Cyber Essentials delivery partner, confirmed that the changes apply to all assessment accounts created after 26 April 2026. Put simply, if you bought your assessment from 27 April 2026 onwards, you’re on Danzell. IASME’s question preview page says the older Willow question set should be used if you purchased before 27 April 2026, and Danzell if you are purchasing from 27 April 2026.

You’ll see both 26 and 27 April quoted online. They describe the same cut-off: accounts created after 26 April, so from 27 April.

Once you’ve applied, you have six months to complete and submit your assessment. That means any Willow account opened before 27 April 2026 will have reached the end of its six-month window by the end of October 2026, so if you’re starting an assessment now, you’re on Danzell.

The five controls have not changed

Cyber Essentials still rests on the same five technical controls set out by the NCSC:

• Firewalls
• Secure configuration
• Security update management
• User access control
• Malware protection

What has changed is how strictly some of them are tested and what counts as “in scope”. If you want a refresher on why these controls matter, my earlier piece on cybersecurity basics for SMEs covers the background.

The questions that now fail you outright

This is the change that matters most. IASME has introduced two security update questions that are marked as automatic fails:

• A6.4 covers high-risk or critical security updates for operating systems and router and firewall firmware.
• A6.5 covers high-risk or critical security updates for applications.

In both cases the updates must be applied within 14 days of release. If you can’t answer yes, you fail the assessment, however well you’ve done elsewhere. The 14-day rule itself isn’t new (it was already in the previous v3.2 requirements). What’s new is that these two questions are now marked as automatic fails, so there’s no room for a borderline answer.

In my experience the common gap here isn’t Windows laptops, which usually update themselves. It’s the router nobody has logged into since it was installed, the old PDF reader on the office PC, the browser plug-in, or a phone that stopped getting updates. Every one of those is in scope.

MFA is now mandatory on cloud services wherever it’s available

The v3.3 requirements state that authentication to cloud services must always use multi-factor authentication. IASME’s guidance is that MFA is mandatory for all cloud services where it’s available, and that failing to use it on any cloud service, whether free, included, or paid, results in an automatic fail.

That “free or included” wording is where people get caught. It isn’t just Microsoft 365 or Google Workspace. Think about your accounting software, your rota or HR system, your CRM, the client portal you log into, your website admin, and the free file-sharing account someone set up years ago. If it holds or processes your organisation’s data and it offers MFA, MFA must be switched on for every user.

The NCSC has also updated its definition of passwordless authentication to include FIDO2, and IASME notes that passkeys are now highlighted as a more secure alternative to passwords. They’re worth considering if your team struggles with MFA codes.

Scope: cloud services can’t be left out

The new requirements define a cloud service as an on-demand, scalable service, hosted on shared infrastructure and accessible via the internet. The NCSC states plainly that cloud services cannot be excluded from scope.

A few other scoping changes are worth knowing:

• The words “untrusted” and “user-initiated” have been removed from the internet connection criteria, so any internet-connected device you specify is in scope.
• If you exclude part of your infrastructure, you must justify it to the assessor and explain how the excluded part is segregated from the rest.
• You must list every legal entity included in the scope, with its name, address, and company number.
• You can now give a detailed scope description, and you must describe any out-of-scope areas (IASME says this part won’t be made public).
• A scope that doesn’t include end-user devices isn’t acceptable.

For group companies, IASME also says individual certificates can be requested for each legal entity in scope, for a small fee, showing that they form part of the wider scope.

The board declaration now carries more weight

Cyber Essentials has always required a board member or director to sign a declaration that the answers are true. Under the 2026 changes, that declaration now includes a statement acknowledging the organisation’s responsibility to maintain compliance with all Cyber Essentials controls throughout the certification period.

That’s a real shift. Cyber Essentials is still a “point in time” assessment, and IASME confirms the point in time is the date the certificate is issued. But the director is now signing to say the controls will stay in place for the year, not just on the day. If a client or insurer later asks whether MFA was on when an incident happened, that declaration is on record.

Changes to Cyber Essentials Plus

If you go on to Cyber Essentials Plus, the technical audit has tightened up in two ways:

• The verified self-assessment must be completed, finalised, and unchanged before Plus testing starts. You can no longer adjust your self-assessment answers based on what the Plus audit finds.
• If a device sample fails the update management test, you must fix it and be retested. The assessor will recheck the original sample and also test a new random sample of devices. A second failure results in revocation of your verified self-assessment certificate.

That second point is the one to plan for. A failed Plus retest doesn’t just cost you Plus; it can cost you the basic certificate as well.

How to pass first time

Here’s the preparation I’d recommend before you open the questionnaire:

1. Download the Danzell questions from IASME’s preview page and read them all before you start. Don’t answer as you go.
2. Build a full device and software list: laptops, desktops, phones, tablets, servers, routers, firewalls, and the operating system and version of each. Anything unsupported must be removed or replaced.
3. List every cloud service the business uses, including the free ones, and confirm MFA is on for every account.
4. Check the update status of everything on your list, including router firmware, and set up automatic updates wherever you can.
5. Confirm your scope, including legal entities, and be ready to explain any exclusions.
6. Make sure the director signing the declaration understands what they’re committing to for the year.
7. Keep a copy of your answers. IASME recommends this so you can refer to them when you recertify.

Renewal

IASME’s FAQs state that Cyber Essentials and Cyber Essentials Plus certificates expire after 12 months, and the scheme is annually renewable. IASME emails a reminder roughly a month before you need to recertify, but I’d start a month or two earlier than that if your certificate is a tender or contract requirement. A lapsed certificate can mean a lost bid, and I cover that in more detail in winning tenders in 2026.

Related reading

• Critical suppliers and the new UK cyber law: what small businesses in the supply chain should prepare
• A simple AI acceptable use policy for small businesses

FAQs

What is the Danzell question set?

Danzell is the Cyber Essentials self-assessment question set that replaced Willow in April 2026. It’s based on the NCSC’s Requirements for IT Infrastructure v3.3 and applies to assessment accounts created after 26 April 2026.

Which Cyber Essentials questions are automatic fails?

A6.4 and A6.5, which cover applying high-risk or critical security updates within 14 days for operating systems, firmware, and applications. Not using MFA on a cloud service where it’s available is also an automatic fail.

Can I leave a cloud service out of my Cyber Essentials scope?

No. The NCSC’s v3.3 requirements state that cloud services cannot be excluded from scope. If a service stores or processes your organisation’s data, it’s in.

How long is a Cyber Essentials certificate valid?

Twelve months. IASME states that both Cyber Essentials and Cyber Essentials Plus certificates expire after 12 months and need to be renewed annually.

How long do I have to complete the assessment?

Six months from the date your assessment account is created. After that, the account may be closed and you’d need to apply and pay again.

What happens if I fail the Cyber Essentials Plus retest?

Under the 2026 rules, a second failure on the update management test results in revocation of your verified self-assessment certificate, not just failure of Plus.

Get it right first time with CAW Consultancy

At CAW Consultancy we prepare businesses for Cyber Essentials and Cyber Essentials Plus. Our Cyber Essentials consultancy is £499 + VAT. We’ll work through the Danzell questions with you, check your devices, cloud services, and MFA, and make sure your scope and answers will stand up before you submit. Your certificate is issued by an IASME-licensed certification body, and their fee is separate. At the time of writing (October 2026), IASME’s published self-assessment fees start at £320 + VAT for micro organisations (0 to 9 employees).

If Cyber Essentials is part of a wider information security journey, my guide to ISO 27001 in plain English explains the next step up.

Call 01257 824481, email Craig@cawconsultancy.co.uk, or visit www.cawconsultancy.co.uk. If you’d like your team to understand the controls too, the ISO Training Institute offers online ISO courses.

Sources

• IASME: Important update, changes to Cyber Essentials for April 2026
• IASME: Upcoming changes to the Cyber Essentials scheme, April 2026 update
• IASME: Preview the self-assessment questions for Cyber Essentials
• IASME: Cyber Essentials frequently asked questions
• IASME: Cyber Essentials
• NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3