Cyber Essentials Changes 2026: The Danzell (v3.3) Update Explained

The Cyber Essentials changes for 2026 took effect on 27 April 2026, when the NCSC’s Requirements for IT Infrastructure v3.3 and IASME’s Danzell question set replaced v3.2 and the Willow question set. The changes that matter most: missing multi-factor authentication (MFA) on a cloud service is now an automatic fail, and so is missing the 14-day deadline for high-risk or critical updates. Scope descriptions must now name every legal entity and describe what is excluded, and when devices fail the Cyber Essentials Plus update tests, the retest now includes a fresh random sample of devices. The five technical controls themselves have not changed.

As an IASME-licensed certification body, we mark Cyber Essentials assessments against Danzell. This guide explains each change, what it means for your answers and what to do before your next assessment or renewal. We review it whenever the question set changes.

Key takeaways

• Danzell (v3.3) applies to assessment accounts created from 27 April 2026.
• Cloud MFA and the 14-day patching rule are now checked by automatic-fail questions.
• You must list every legal entity in scope and describe any excluded infrastructure.
• Plus retests after failed update tests add a new random device sample, and a second failure means the basic certificate is revoked.
• Passkeys are highlighted as a stronger sign-in method, and backup guidance has moved up the document.

Cyber Essentials changes 2026 at a glance

Each change is explained in the sections below.

When did the Cyber Essentials 2026 changes come into force?

According to IASME’s announcement, the changes apply to all assessment accounts created after 26 April 2026. IASME published the Danzell question set in February 2026 so that organisations and certification bodies could prepare.

If you opened an assessment account before 27 April 2026, IASME gave you six months to certify using the previous (Willow) requirements. If yours has been open since the spring, check with your certification body how long you have left; after that, you will need to answer the Danzell questions.

The question set changes most years, usually in April:

You can read the current requirements document on the NCSC Cyber Essentials resources page.

What are the new automatic-fail questions?

The biggest practical change is in marking. Three areas that were already requirements are now checked by questions that fail the whole assessment on their own, regardless of how well you score elsewhere.

IASME’s wording is blunt: non-compliance results in an automatic failure of the assessment, regardless of performance in other areas. You would then need to fix the issue and resubmit within your package’s limits, or start again.

An update falls under the 14-day rule if the vendor rates it critical or high risk, if it fixes a vulnerability with a CVSS v3 score of 7 or above, or if the vendor gives no severity. Our Cyber Essentials requirements checklist sets out every rule in full.

What changed in the v3.3 requirements document?

The NCSC’s document was revised in four ways that affect how you answer:

• A definition of cloud services. v3.3 defines a cloud service, in summary, as a scalable service hosted on shared infrastructure, accessed over the internet with an account. If a service fits that description and holds or processes your data, it is in scope and needs MFA.
• Passwordless authentication. The user access control section now highlights passwordless methods such as passkeys as a more secure alternative to passwords. They are encouraged, not required.
• Backups. Guidance on backups has moved earlier in the document to stress how they help you recover from an incident. Backups are still recommended rather than assessed.
• “Point in time” clarified. The scheme now states that the point in time a certificate reflects is the date the certificate is issued.

The password rules themselves are unchanged. A password used with MFA needs at least 8 characters. Without MFA, it needs at least 12 characters, or 8 with automatic blocking of common passwords, plus protection against guessing. Our Cyber Essentials password policy guide covers the full rules, and our guide to the five Cyber Essentials controls shows where they fit.

What changed in how scope is described?

Scope gets more detail and more transparency under Danzell:

The practical effect is that buyers checking your certificate see more precisely what it covers. A vague scope such as “head office network” now looks weak next to a competitor’s detailed one. If you’re unsure where your boundary sits, our free Cyber Essentials scope questionnaire walks you through it.

What changed for Cyber Essentials Plus?

Three changes make the Plus audit stricter:

1. Retests widen the sample. If the audit finds a device missing updates, the retest rechecks the original sample and also tests a new random sample of devices. Patching only the devices you expect to be tested no longer works.
2. A second failure has consequences. IASME states that a second failure will result in the revocation of the verified self-assessment (basic) certificate.
3. No rewriting answers. The basic self-assessment must be completed, finalised and left unchanged before Plus testing starts, so answers can no longer be adjusted to match what the audit finds.

The rest of the audit follows the NCSC’s Cyber Essentials Plus test specification, as before. Our Cyber Essentials Plus requirements checklist explains the tests and the device sample sizes, and our comparison of Cyber Essentials vs Cyber Essentials Plus helps if you are deciding between the two.

What stayed the same?

Most of the scheme is unchanged, which is useful if you certified last year:

• The five controls: firewalls, secure configuration, security update management, user access control and malware protection.
• The 14-day window for high-risk and critical updates (now enforced by automatic-fail questions).
• Certificates last 12 months, with no grace period.
• Cyber Essentials Plus must be completed within three months of the basic certificate.
• The IASME fee bands for basic Cyber Essentials, which start at £320 + VAT for micro organisations.

What should you do before your next assessment or renewal?

Work through this list before you open the Danzell questions:

1. List every cloud service your staff use, including the ones one team signed up for, and confirm MFA is enforced for every user on each one that offers it.
2. Run a patch report covering operating systems, router and firewall firmware, and applications including browser extensions. Anything high or critical older than 14 days must be fixed before you submit.
3. Remove unsupported software or move it to a segregated network with no internet access.
4. Write your scope properly. Gather company names, registered addresses and company numbers for every entity, and describe anything you exclude.
5. If you are going for Plus, patch the whole estate, not a sample, and make sure your self-assessment answers are accurate before the audit starts.
6. Consider passkeys for services that support them, and review your backups even though they aren’t assessed.

You can preview the questions on our Cyber Essentials questionnaire page. If your certificate is due soon, our Cyber Essentials renewal page explains the timing, and our Cyber Essentials readiness check gives you a quick view of where you stand.

Will Cyber Essentials change again in 2027?

Nothing had been announced as of 13 October 2026. The requirements have been revised in most recent years, usually in April, and IASME gave about six months’ notice of the 2026 changes. Our Cyber Essentials 2027 guide records what is confirmed about the next update. Until a new question set goes live, Danzell and v3.3 are the rules every new assessment and renewal follows.

Why use Sovereign Secure?

Sovereign Secure Ltd is an IASME-licensed Cyber Essentials certification body, so the same organisation supports your preparation and marks your Danzell answers. Every package includes a pre-assessment check and a support call of up to an hour, which is where we catch cloud MFA gaps and overdue updates before they become automatic fails. We are also ISO 27001 certified and a PCI SSC Qualified Security Assessor (QSA) company.

Next step

If you’re certifying for the first time or renewing under Danzell, see our Cyber Essentials certification packages, which start at £320 + VAT. If you need hands-on help closing gaps first, our Cyber Essentials consultancy team can work with you or your IT provider.