June sits at the mid-point of the typical Cyber Essentials certificate lifecycle. For SMEs that renewed under the Willow scheme (version 3.2), this is the moment to verify that your controls still meet the current Danzell requirements (version 3.3) before your next reassessment window arrives.

The scheme itself has not changed overnight. But the way the IASME panel assesses compliance against Danzell controls — particularly around patch management cadence and remote access logging — can differ enough to expose gaps that were never flagged during your last self-assessment.

This is not about alarm. It is about knowing where you stand six months into your certificate term, so renewal is a formality rather than a scramble.

Has your Cyber Essentials certificate drifted out of compliance?

The five core controls remain the same: firewalls and security gateways, secure configuration, access control, malware protection, and patch management. What has shifted is how strictly those controls are mapped to the control objectives in the current assessment framework.

Organisations certified under Willow (3.2) should run a quick gap check against the five areas below. If any item on this list feels uncertain, your certificate may be at risk when reassessment comes around.

Firewall and security gateway controls

Your perimeter defence should still be in place, but Danzell assessors now look more closely at default-deny policies and the documentation of allowed inbound traffic rules. If your firewall has been tweaked ad hoc over the past six months without a change log, that is the first thing an assessor will ask to see.

The requirement is clear: every rule must serve a documented business purpose. This is not opinion — it is written into the scheme guidance.

Secure configuration standards

Hardening baselines have not changed, but the expectation around device coverage has tightened. If you have onboarded new equipment — a second site, remote staff laptops, cloud instances — those devices need to meet the same baseline standards as your original fleet.

This is where many SMEs drift. A new hire's laptop arrived in March, configured quickly to get someone productive, and never received a hardening check. That single device can be grounds for a failed reassessment. Organisations that work with an IT provider who enforces a consistent standard across all devices tend to avoid this trap entirely.

Access control and privilege management

Least-privilege access is a perennial requirement, but Danzell-era assessments pay more attention to dormant accounts and shared credentials. If a former employee's account is still active, or if two people share an admin password for a shared system, that is a direct control failure.

This is not a recommendation. It is a scheme requirement.

Malware protection coverage

Your endpoint protection should still be active and updating. The question to ask is whether your antivirus or EDR solution covers every device — including any contractors' machines that connect to your network. Shadow IT is a common blind spot at reassessment time.

Patch management cadence

This is the area where Willow-to-Danzell transitions have caused the most reassessment failures. The requirement has always been to apply security patches within a reasonable timeframe. What Danzell assessors now expect is evidence of a documented patch cycle and proof that critical patches were applied within 14 days of release.

If your team is applying patches but cannot produce a log showing when security updates were deployed, that gap will be flagged.

What changed between Willow (3.2) and Danzell (3.3)?

The IASME panel does not publish a change log between scheme versions, but practitioners and accredited assessment bodies have flagged several areas where enforcement intensity has increased:

• Patch management documentation is now expected, not optional.

• Remote access methods (VPNs, RDP, cloud portals) are scrutinised more closely for logging and MFA coverage.

• Secure configuration baselines are checked against a broader device inventory, not just the devices listed on your original assessment.

• Password policy documentation is reviewed for alignment with current NCSC guidance rather than legacy standards.

None of these changes alter the five core controls. They sharpen how those controls are verified during assessment.

How to run a mid-year Cyber Essentials gap check

You do not need an external consultant to perform this exercise. A structured internal review takes a few hours and can save you a failed reassessment six months down the line.

Step 1: Inventory your device estate

List every device that connects to your network — workstations, servers, mobile devices, IoT equipment, contractor devices. Compare this list against what was included in your original assessment. Any additions are potential control gaps.

Step 2: Verify patch logs

Pull your endpoint management console or ticketing system and pull patch deployment records for the past six months. Are critical security patches applied within 14 days? Can you produce the evidence if asked?

Step 3: Audit access controls

Run a report on active user accounts. Identify dormant accounts, shared credentials, and any admin-level access that has not been reviewed recently. Remove or reassign anything that does not belong.

Step 4: Review firewall rules

Export your firewall rule set and cross-reference each entry against documented business needs. Remove any rules that no longer serve a purpose and document the rationale for those that remain.

Step 5: Confirm malware protection coverage

Verify that every device on your inventory has active, up-to-date endpoint protection. Check that updates are automatic and not dependent on user action.

When should you bring in an external review?

If any of the five steps above reveals a gap you cannot confidently close, or if your IT team is stretched and this check would pull them away from revenue-generating work, an independent review is worth the investment.

A focused gap assessment costs less than a failed reassessment and gives you a clear remediation roadmap before your renewal window.

Frequently asked questions

How often do I need to check my Cyber Essentials compliance?

The scheme requires annual reassessment. A mid-year internal check — like the one outlined above — is good practice, not a scheme requirement. It exists to prevent surprises at renewal time.

Does Cyber Essentials cover ransomware protection?

Cyber Essentials addresses the baseline controls that reduce your exposure to most cyber attacks, including those that lead to ransomware. It does not prevent all ransomware attacks or other specific threats. For comprehensive ransomware defence, organisations typically layer additional controls such as backup and recovery processes and staff training.

What happens if I fail my Cyber Essentials reassessment?

You can re-sit the assessment, but there is a cost and a delay in certification. If your certificate has already expired, you cannot operate under the Cyber Essentials banner until you pass again. Some clients and tenders require a valid certificate at the point of contract award.

Can I switch assessment bodies between certification cycles?

Yes. The Cyber Essentials scheme is managed by the IASME Consortium on behalf of NCSC, and you can use any accredited assessment body for your reassessment. Your previous certification history does not bind you to a specific provider.

Next steps

If this mid-year check has raised questions about your compliance posture, a focused review is the fastest way to clarity.

Book a Security Triage Call to get a baseline assessment of your current controls and a prioritised remediation plan.

Or explore our Cyber Essentials guidance for a deeper look at the scheme requirements and how we help organisations stay compliant.