The Danzell update (version 3.3) took effect on 27 April 2026, introducing the most significant enforcement changes to the Cyber Essentials scheme in recent years. The five core technical controls — firewalls, secure configuration, user access control, malware protection, and security update management — remain unchanged. What has changed is how rigorously they are assessed, and the consequences of falling short.

If your organisation is preparing for Cyber Essentials or Cyber Essentials Plus certification, understanding exactly what changed on 27 April is not optional. Missing these updates means risking an automatic failure before you even submit your self-assessment.

What actually changed in Cyber Essentials v3.3?

The changes cluster into three areas: cloud scope expansion, auto-fail criteria for MFA and patching, and revised assessment methodology. Each is grounded in the NCSC Requirements for IT Infrastructure v3.3 and IASME's April 2026 guidance.

Cloud services are now explicitly in scope

The most fundamental change is the removal of ambiguity around cloud services. Under the previous Willow version (v3.2), many organisations scoped out cloud platforms from their Cyber Essentials assessment, arguing that SaaS providers were outside their direct control.

Danzell closes that loophole. The updated requirements now define "cloud services" explicitly and state that any service storing or processing your organisation's data is in scope — full stop. This includes free accounts, trial licences, and consumer-tier services used for business purposes.

In practice, this means Microsoft 365, Google Workspace, Mailchimp, Dropbox, and similar platforms must all be accounted for in your assessment scope. You cannot exclude them by claiming they are managed by a third party.

MFA is now an automatic failure condition

One of the most consequential changes under Danzell is the introduction of auto-fail criteria for Multi-Factor Authentication. If your organisation does not implement MFA on any cloud service where it is available, you will automatically fail the assessment — regardless of how well you perform on other controls.

This applies to standard user accounts, admin accounts, shared accounts, and service accounts. Simply enabling MFA for privileged users while leaving high-risk accounts unprotected is no longer acceptable under the new marking criteria.

The NCSC's position is clear: MFA is not a discretionary improvement but a baseline expectation. This brings Cyber Essentials into alignment with the NCSC's recommended best practice and removes the previous ambiguity about whether MFA was mandatory or merely encouraged.

Patching is now an auto-fail area

Two new questions in the Danzell question set — A6.4 and A6.5 — address security update management as automatic failure conditions. These questions require evidence that high-risk or critical security updates and vulnerability fixes are installed within 14 days of release across all in-scope devices, including operating systems, router and firewall firmware, and applications (including associated files and extensions).

Previous versions of the requirements already asked organisations to keep software up to date. What Danzell changes is the marking treatment: failure on either A6.4 or A6.5 results in an automatic overall failure, even if every other control is met.

This means patching processes must be demonstrable, not just documented. Assessors will test evidence of patching compliance, not merely review a policy statement.

Assessment methodology changes for Cyber Essentials Plus

The Cyber Essentials Plus assessment methodology has been substantially restructured. The most notable change is the introduction of double sampling:

1. A random sample of devices is scanned and tested for critical vulnerabilities

2. A second sample is taken after remediation to verify fixes

This two-phase approach makes it harder to game the assessment through temporary fixes applied only for the initial scan. It also means organisations need ongoing patching discipline throughout the certification period, not just at the point of assessment.

Additionally, 90-day timelines have been introduced for certain remediation windows, adding pressure to maintain consistent security hygiene rather than conducting pre-assessment sprint fixes.

BYOD controls are now non-discretionary

The previous question set left BYOD (Bring Your Own Device) controls largely to organisational discretion. Danzell changes this: Mobile Device Management (MDM) or Mobile Application Management (MAM) solutions are now considered non-discretionary for organisations that permit BYOD access.

The safest approach is to enforce an MDM policy that either enrolls BYOD devices (bringing them into scope with managed controls) or blocks access from unmanaged devices entirely. Simply having a BYOD policy without technical controls is no longer sufficient.

Scoping boundaries are now technical, not organisational

Under Danzell, scope must be defined by firewalls and network boundaries — not by user departments or business units. "Everything" is not an acceptable answer, but neither is scoping by department alone. You need to list your in-scope devices, users, and network boundaries with specificity.

This change addresses a common failure pattern where organisations submitted vague scope descriptions that assessors could not verify against actual network topology.

Individual entity certificates for group companies

A new certificate type is now available: individual Cyber Essentials certificates for each legal entity within a larger scope assessment, with clear notation that certification is part of a wider scope. This is particularly relevant for group companies operating different IT infrastructure environments under a single parent organisation.

When do these changes apply?

The Danzell question set and v3.3 requirements apply to all assessment accounts created on or after 27 April 2026. Any organisation with an active assessment account created before this date has a six-month grace period to complete certification using the previous Willow (v3.2) requirements, with the deadline being 27 October 2026.

If you are mid-process under Willow, the decision to finish under the previous version or switch early depends on your organisation's current MFA and patching posture. Organisations with weak controls in these areas should consider switching to Danzell now rather than waiting, as the requirements are more transparent about what is needed.

What are the most common Cyber Essentials v3.3 failures?

Across assessments conducted under Danzell, these are the issues that most commonly cause failures:

MFA not enabled on all cloud accounts. Organisations that enable MFA for privileged users but neglect shared accounts, service accounts, or free-tier services consistently fail on the MFA auto-fail question.

Patch records that do not match actual practice. Many organisations document patching policies but cannot produce evidence of timely installation (within 14 days for high-risk or critical updates) across all in-scope devices, particularly for router firmware and application extensions.

Poorly scoped cloud platforms. Leaving SaaS services out of scope or describing scope in vague terms leads to assessor queries, submission rejections, and timeline delays.

BYOD devices without MDM/MAM controls. Organisations permitting BYOD access without enforceable device management controls fail on the updated BYOD requirements.

How to Prepare for Cyber Essentials v3.3 Certification

The changes under v3.3 are not a fundamental overhaul of the scheme — the five controls remain the same. They represent stricter enforcement of existing expectations, and organisations that have been maintaining genuine security hygiene should find the transition manageable. Here is a practical approach:

Inventory all cloud services immediately. Every service that stores or processes organisational data must be in scope. This includes free accounts and trial licences. No exclusions are permitted.

Enable MFA everywhere. This means every user account, shared account, and service account across all in-scope cloud platforms — including those where MFA is free or included by default.

Verify patching evidence. Ensure your patching processes produce records that demonstrate timely installation (within 14 days for high-risk or critical updates) across all in-scope devices, not just servers and workstations.

Engage your assessor early. Discuss scope alignment before purchasing certification. Clarify any ambiguous boundaries and confirm that your documentation matches actual technical practice.

Run an internal review. Treat a pre-assessment self-review like a dry run. Identify gaps in MFA coverage, patching records, and scope documentation before submitting your VSA (Vulnerability Scanning Assessment).

Why this matters for procurement and compliance

A valid Cyber Essentials certificate is increasingly required for government contracts, public sector supply chains, insurance requirements, and general commercial due diligence. The Danzell changes raise the bar for what a certificate actually demonstrates — moving from paperwork compliance toward genuine security posture verification.

Organisations that have been certified under Willow may find their existing certificates remain valid until expiry, but any recertification or new certification after 27 April 2026 will use the Danzell question set. If your current controls are not aligned with the updated requirements, the gap between where you are and where you need to be may be wider than expected.

Next steps

If you are unsure whether your organisation is ready for Cyber Essentials certification under the v3.3 requirements, start with a Security Triage Call to assess your position across all five controls before committing to the certification process. A baseline review identifies gaps in MFA coverage, patching discipline, and scope documentation so you can address them proactively rather than facing an automatic failure.

For organisations that want to understand how our managed IT support standards align with Cyber Essentials requirements, our Standard by Default framework provides a practical baseline. Where consistency between control and outcome is the difference between guesswork and confidence, our standardisation approach shows how to build that consistency into your daily operations.

If you need support navigating the Danzell changes and preparing for Cyber Essentials certification, our Cyber Essentials service page outlines how we help organisations achieve and maintain compliance.