Cyber Essentials is a UK Government-backed certification that helps businesses guard against common cyber threats. It focuses on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.
The latest update, Danzell, applies to new Cyber Essentials applications started from 27 April 2026. It is not a complete overhaul, but it does tighten requirements and clarify what businesses need to include in their assessment.
MFA must be enabled for cloud services wherever it is available, including where it is offered as a paid option. Businesses should check the services they use and confirm that MFA is switched on for relevant accounts.
Businesses need to define what is included in their assessment. The updated requirements make clear that cloud services holding or processing organisational data must be included. End-user devices cannot be left out of scope.
Businesses should identify the legal entities included in their certification and make sure their answers accurately reflect the systems in scope. Cyber Essentials is also an ongoing commitment: the controls need to be maintained throughout the certification period.
If your application began before 27 April 2026, it can continue under the previous version of the requirements. For new applications from that date, businesses should prepare against Danzell and version 3.3. If you are renewing, check which requirements apply to your assessment before you begin.
You may have seen the previous question set referred to as Willow. Danzell replaces it for new applications from 27 April 2026; Willow is relevant only to applications started before then.
Before starting or renewing your assessment:
Check which Cyber Essentials requirements apply to your application.
List the devices, cloud services and legal entities that need to be included.
Confirm that MFA is enabled wherever it is available.
Make sure your assessment answers reflect your current systems and working practices.
Cyber Essentials still provides a clear baseline, but the updated requirements make it important to prepare carefully. Cyber Tec can help you understand what applies to your organisation and work through the certification process. Visit our Cyber Essentials certification page to find out more.