Cyber Essentials is a UK Government-backed certification that helps businesses guard against common cyber threats. It focuses on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.
The latest update, Danzell, applies to new Cyber Essentials applications started from 27 April 2026. It is not a complete overhaul, but it does tighten requirements and clarify what businesses need to include in their assessment.
What has changed under Danzell?
Multi-factor authentication for cloud services
MFA must be enabled for cloud services wherever it is available, including where it is offered as a paid option. Businesses should check the services they use and confirm that MFA is switched on for relevant accounts.
Faster security updates
High-risk and critical security updates must be installed within 14 days of release. This includes updates for in-scope software and devices. The NCSC also recommends applying other updates promptly.Clearer scope, including cloud services
Businesses need to define what is included in their assessment. The updated requirements make clear that cloud services holding or processing organisational data must be included. End-user devices cannot be left out of scope.
More attention to the assessment process
Businesses should identify the legal entities included in their certification and make sure their answers accurately reflect the systems in scope. Cyber Essentials is also an ongoing commitment: the controls need to be maintained throughout the certification period.
What if your organisation is already certified?
If your application began before 27 April 2026, it can continue under the previous version of the requirements. For new applications from that date, businesses should prepare against Danzell and version 3.3. If you are renewing, check which requirements apply to your assessment before you begin.
You may have seen the previous question set referred to as Willow. Danzell replaces it for new applications from 27 April 2026; Willow is relevant only to applications started before then.
Preparing for the 2026 Cyber Essentials standard
Before starting or renewing your assessment:
-
Check which Cyber Essentials requirements apply to your application.
-
List the devices, cloud services and legal entities that need to be included.
-
Confirm that MFA is enabled wherever it is available.
-
Make sure your assessment answers reflect your current systems and working practices.
Cyber Essentials still provides a clear baseline, but the updated requirements make it important to prepare carefully. Cyber Tec can help you understand what applies to your organisation and work through the certification process. Visit our Cyber Essentials certification page to find out more.
