What changed in Cyber Essentials for 2026 (Danzell)

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

Key dates: the six-month transition window has now closed

IASME published the Danzell question set on 13 February 2026 (announced 12 February 2026 and updated 25 June 2026), and it took effect for all assessment accounts created after 26 April 2026 (IASME). Organisations that opened an assessment account before 27 April 2026 were given six months (until 26 October 2026) to finish under the old rules. That transition window has now closed: every new application and every annual renewal is now marked strictly under v3.3 and Danzell.

Every April 2026 change — and what it means for you

1. Cloud MFA is now an automatic fail (even if MFA is a paid extra)

The change: Multi-Factor Authentication (MFA) is mandatory on all cloud services where the vendor makes it available — whether free, included in your subscription, or a paid add-on. Failing to implement it automatically fails the assessment.

What this means for you: Audit every online tool your staff sign in to with work email (not just Microsoft 365) and switch MFA on for 100% of users before applying. See MFA and cloud services.

2. Two 14-day patching questions are now automatic fails

The change: Question A6.4 (operating systems and router/firewall firmware) and Question A6.5 (applications and their associated files and extensions) are now designated as automatic-fail questions. High-risk, critical (CVSS v3 7.0+) and unrated security updates must be installed within 14 days of release.

What this means for you: Manual patching is no longer safe; set automatic update deadlines well inside 14 days and check router firmware and third-party apps. See the 14-day patching rule.

3. Cloud services are defined and can never be excluded

The change: Version 3.3 adds an explicit definition of a cloud service (any on-demand internet service accessed via company credentials or a business email address that stores or processes organisational data) and states definitively that cloud services cannot be excluded from scope.

What this means for you: You cannot carve out a tricky SaaS portal from your scope statement. See which cloud services count.

4. Detailed scope, out-of-scope justifications and legal entity listing

The change: Character limits on scope descriptions have been removed; you must describe any excluded infrastructure (kept private for the assessor) and justify how it is segregated; every legal entity in scope must be listed with its name, address and company number (visible on the digital certificate platform); and you can buy individual per-entity certificates as part of a group scope for a small charge.

What this means for you: Use our Scope builder to list your legal entities and check your boundaries before you start.

5. “Point in time” means the certificate issue date

The change: IASME explicitly defines the assessment “point in time” as the date the certificate is issued.

What this means for you: Every operating system, router and application in scope must still be supported on the day your certificate is awarded.

6. Director's declaration now covers the whole 12-month year

The change: The board member or director signing the verified self-assessment now formally acknowledges responsibility for maintaining compliance with all Cyber Essentials controls throughout the entire 12-month certification period.

What this means for you: You cannot tidy up for assessment week and turn controls off afterwards.

7. Stricter Cyber Essentials Plus retesting and revocation

The change: In Cyber Essentials Plus, if your initial device sample fails the update check, the retest covers both the original sample and a new random sample of devices; failing that retest revokes your basic Cyber Essentials certificate; and you are prohibited from changing your self-assessment answers once Plus testing starts.

What this means for you: Scan and remediate your whole fleet (not just a handful of machines) before Plus testing begins. See Cyber Essentials vs Plus.

8. Other updates in NCSC Requirements v3.3

• Passkeys recognised: Passwordless authentication is updated to include FIDO2 passkeys, which count as MFA.
• Simpler scoping language: The qualifiers “untrusted” and “user-initiated” have been removed from internet connection scoping rules.
• Software development: “Web applications” is updated to “Software development” and points to the NCSC Software Security Code of Practice.
• Backups emphasised: Section C gives stronger prominence to regular cloud or offline backups (disconnecting USB/external drives when not backing up).

What happens next April (2027)?

The NCSC and IASME review and update Cyber Essentials every April. If you already hold a certificate — or once you pass this year — set up our free Renewal reminder and we’ll email you what changes next April before your renewal is due.