In short: Danzell is the Cyber Essentials question set that came into force on 27 April 2026 alongside the NCSC's Requirements for IT Infrastructure v3.3. It replaced Willow, made missing MFA on cloud services and late critical updates automatic fails, requires every in-scope legal entity to be listed, and tightened the Cyber Essentials Plus retest rules.
Timeline
Danzell applies to assessment accounts created from 27 April 2026. IASME set out the changes in February 2026 and published the new questions ahead of the start date. Organisations that opened an account under Willow before then had six months to finish it, and that transition window has now closed, so every assessment today uses Danzell.
| Question set | Requirements | Introduced | Headline change |
|---|---|---|---|
| Montpellier | v3.1 | April 2023 | Updated requirements and question set |
| Willow | v3.2 | 28 April 2025 | Passwordless authentication recognised |
| Danzell | v3.3 | 27 April 2026 | Cloud services defined and never excludable; new automatic fails |
The Cyber Essentials Plus Test Specification was not reissued alongside Danzell: version 3.2, dated 28 April 2025, is still the latest the NCSC lists. At the time of writing (October 2026) we have seen no announced changes for 2027.
What changed in Requirements v3.3
The NCSC's *Requirements for IT Infrastructure* v3.3 lists these changes:
- A definition of cloud service: an on-demand, scalable service on shared infrastructure, reached over the internet through an account, that stores or processes your data. See cloud services and Cyber Essentials.
- Cloud services cannot be excluded from scope, stated outright.
- Passwordless authentication now includes FIDO2, and FIDO2 authenticators count as passkeys and as MFA.
- The Software Security Code of Practice is referenced in the software development part of the scope section.
- Scope criteria no longer refer to "untrusted" or "user-initiated" connections: devices are in scope if they can accept connections from internet-connected devices, connect out over the internet, or control data flow between the two.
- Backups are emphasised. They remain strongly recommended rather than a technical requirement.
The five controls and their core requirements are otherwise unchanged. Our requirements hub explains each one.
Stricter marking: the new automatic fails
IASME's marking under Danzell turns several requirements into pass-or-fail points:
| Automatic fail | What triggers it |
|---|---|
| Missing MFA on cloud services | Any in-scope cloud service where MFA is available (free, included or paid) but not enforced |
| Question A6.4 | Critical or high-risk updates to operating systems or router and firewall firmware not installed within 14 days |
| Question A6.5 | Critical or high-risk updates to applications not installed within 14 days |
The MFA rule was announced by IASME in November 2025, giving organisations several months' notice. Alongside these, remember that software must be supported on the date your certificate is issued, so anything past its vendor's end of support has to be upgraded, removed or isolated first. Together these points deserve the most attention when you prepare. See Cyber Essentials MFA requirements and security update management.
Legal entities, scope descriptions and the certificate
Danzell makes certificates more precise about what they cover:
- Every legal entity in scope must be listed with its name, address and company number. Individual certificates for each entity are available for a small extra fee, and each shows it is part of a wider scope.
- A detailed scope description appears on the digital certificate platform, so a buyer can see what was assessed. Descriptions of excluded areas are not published.
- The point in time the certificate reflects is the date it is issued, and your systems must be supported on that date.
For buyers, this makes a certificate check more useful. For applicants, it means a narrow or vague scope is now visible to the customers who asked for the certificate.
A bigger commitment from the board
The declaration signed by a board member or equivalent now goes further. As well as confirming the answers are accurate, the signatory accepts responsibility for keeping the organisation compliant throughout the certification period, not just on submission day.
That changes how organisations should treat Cyber Essentials: as twelve months of patching within 14 days, keeping MFA on every new cloud service and removing unsupported devices as they age, rather than an annual sprint. Our renewal guide covers how to keep on top of it.
Changes for Cyber Essentials Plus
Danzell also tightened the rules for the audited level:
- The verified self-assessment must be final and unchanged before Cyber Essentials Plus testing begins. You cannot change your answers in response to what the audit finds.
- If a security update management sample fails, the retest covers the original sample plus a new random sample.
- A second failure revokes the Cyber Essentials certificate issued from your self-assessment, not just the Plus attempt.
The practical lesson is to rehearse before the assessor arrives. Our guide to the Cyber Essentials Plus audit explains the process and how we prepare you.
What to do now, and how we help
If you certified under Willow, your current certificate stays valid until it expires, but your renewal will be marked under Danzell. Before then:
- Read the Danzell question set and list your in-scope legal entities.
- Inventory every cloud service and enforce MFA on all of them.
- Check that critical and high-risk updates for operating systems, firmware and applications are going on within 14 days, with evidence.
- Remove or isolate unsupported software, including Windows 10 devices without Extended Security Updates.
- Brief the director who will sign on what the declaration now means.
Our gap analysis is built around the Danzell questions and auto-fail points. To check your readiness for the new rules, contact us.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
When did the Danzell question set come in?
Danzell applies to Cyber Essentials assessment accounts created from 27 April 2026, alongside the NCSC's Requirements for IT Infrastructure v3.3. Accounts opened earlier had six months to complete under Willow, and that window has now closed.
What is the difference between Willow and Danzell?
Willow (v3.2, April 2025) recognised passwordless authentication. Danzell (v3.3, April 2026) defines cloud services and bars excluding them, adds automatic fails for missing cloud MFA and late critical updates, requires legal entities to be listed, and tightens Cyber Essentials Plus retests.
Is backup now a Cyber Essentials requirement?
No. Requirements v3.3 places more emphasis on backing up data and strongly recommends it, but backup is still not one of the technical requirements you are marked on.
Does Danzell affect my existing certificate?
A certificate issued under Willow remains valid until it expires 12 months after issue. Your renewal will use the then-current question set, which is Danzell, so prepare for the new automatic fails before you reapply.
Has the Cyber Essentials Plus test changed under Danzell?
The NCSC test specification is still version 3.2 from April 2025, but the rules around it changed. Your self-assessment must be final before testing, a failed update sample is retested with a new random sample added, and a second failure revokes your Cyber Essentials certificate.