What the Cyber Essentials Danzell Update Means for Your Business

If your business holds Cyber Essentials, or you are thinking about getting it, the question set changed in April. Here is a plain summary of what to know before your next assessment.

From 27 April 2026, anyone buying a Cyber Essentials assessment uses a new question set called Danzell, based on version 3.3 of the Requirements for IT Infrastructure.

Applications started before that date can continue under the previous version, known as Willow, and version 3.2 of the requirements.

My role is to understand what a business needs, then bring together the right products, suppliers and specialist expertise. So this post sticks to what the published requirements say and what they can mean for the equipment, licences and technology businesses rely on.

What v3.3 says is new

The requirements document lists these changes:

• A definition of "cloud services"

• A definitive statement that cloud services cannot be excluded from scope

• An updated definition of passwordless authentication, now including FIDO2

• A Software Security Code of Practice for software development

• More emphasis on backing up data

Cloud services are in scope

The document is direct: "Cloud services cannot be excluded from scope." If your business data or services sit in a cloud service, that service is part of the assessment. The document names Microsoft 365, Dropbox and Gmail as examples of software as a service. You remain responsible for configuring them securely.

So when you list what is in scope, include every cloud service that holds business data, not just the obvious ones.

MFA on cloud services

The requirement reads: "implement MFA, where available". It adds that authentication to cloud services "must always use MFA".

In the Danzell question set, you declare whether your cloud services offer MFA. If a service you list as having no MFA option does offer one, that is an automatic fail. MFA must also be applied to all administrators and to all users of your cloud services, and answering no on either means the assessment fails.

In practice, the things worth checking are admin accounts set up long ago, services where MFA exists but was never switched on, and tools added over the years that nobody has reviewed.

Security updates within 14 days

Two separate questions cover patching.

• Operating systems and router and firewall firmware: critical and high-risk updates installed within 14 days of release.

• Software, including associated files and extensions: the same 14 days.

The guidance says that if you cannot meet this at all times, you will not achieve compliance. The requirements define critical or high risk as vendor-rated critical or high risk, or a CVSS v3 score of 7 or above. All software must also be licensed and supported, and removed when it becomes unsupported.

The practical gaps tend to be laptops that are rarely switched on, router and firewall firmware that is updated by hand, and applications that Windows Update does not cover. This is also where hardware refresh and licensing matter: equipment or software that the vendor no longer supports cannot stay in scope.

Defining your scope

You must define the scope boundary clearly: the business unit, the network boundary and the physical location, and agree it with your Certification Body before assessment. A scope that excludes end-user devices is not acceptable. The document says certifying the whole IT infrastructure gives the best protection.

A short checklist before you buy an assessment

Cloud and MFA

• Have we listed every cloud service that holds business data?

• Is MFA on for every user and every administrator of each one?

• Do admins use separate accounts for admin work only?

Updates and equipment

• Are critical and high-risk updates installed within 14 days, including on router and firewall firmware?

• Is every device and application still licensed and supported by its vendor?

• Are rarely used laptops getting updates?

Accounts

• Have leavers' accounts been disabled or removed?

Scope

• Is the scope boundary written down, including end-user devices and cloud services?

Where I can help

I do not carry out the assessment. IASME and its Certification Bodies do that, and NCSC-assured Cyber Advisors can help with the controls. What I can do is look at your Microsoft 365 licences, devices and network equipment, and make sure what you buy and renew supports the requirements above, bringing in specialist help where it is needed.

If you want to talk through where you stand, email me what you need and I will come back to you personally.

Craig Wardle is Director of Nevada IT Ltd, a UK business technology supplier helping organisations with hardware procurement, Microsoft 365 licensing, networking, backup, security and wider technology requirements.