Check your readiness
Change log

Cyber Essentials change log: every scheme version

Every version of the Cyber Essentials requirements and question set, newest first, with what changed and which questions it touched. Current: v3.3 and the Danzell question set, April 2026.

Updated 3 November 2026
Short answer

The current Cyber Essentials version is Requirements for IT Infrastructure v3.3 with the Danzell question set, effective for assessment accounts opened from 27 April 2026. It replaced v3.2 and Willow (April 2025), which replaced v3.1 and Montpellier (April 2023). Each entry below quotes the NCSC's own what's new list and maps it to questions.

Key facts
Current
v3.3 · Danzell question set · effective 27 April 2026
Versions logged
v3.3 (Danzell), v3.2 (Willow), v3.1 (Montpellier)
Next step
Check your answers against the current question set before you submit or renew
Last reviewed
3 November 2026

What is the current Cyber Essentials version?

The current version is Requirements for IT Infrastructure v3.3 with the Danzell question set, in force from 27 April 2026. Read what changed in v3.3 before you start or renew an assessment.

Which versions of Cyber Essentials have there been?

This log covers 3 versions, newest first: v3.3 (Danzell, 27 April 2026), v3.2 (Willow, 28 April 2025), v3.1 (Montpellier, 24 April 2023).

  1. v3.3 · Danzell CurrentCyber Essentials changes April 2026: Danzell question set and requirements v3.3Every change in Cyber Essentials requirements v3.3 and the Danzell question set: the six NCSC what's new items, the new auto-fail questions, and the IASME scope, certificate and CE Plus changes from 27 April 2026.Effective 27 April 2026Read what changed
  2. v3.2 · WillowCyber Essentials changes April 2025: Willow question set and requirements v3.2What changed in Cyber Essentials requirements v3.2 and the Willow question set from 28 April 2025: passwordless authentication, the vulnerability fixes wording, plugins renamed extensions, and the renamed CE Plus test specification.Effective 28 April 2025Read what changed
  3. v3.1 · MontpellierCyber Essentials changes April 2023: Montpellier question set and requirements v3.1What changed in Cyber Essentials requirements v3.1 and the Montpellier question set from April 2023: firmware in scope, third-party devices, device unlocking, malware protection and zero trust.Effective 24 April 2023Read what changed

What changed between versions, at a glance?

VersionEffectiveHeadline changes
v3.3 · DanzellAccounts created from 27 April 2026Cloud services defined and cannot be excluded; FIDO2 regarded as MFA; MFA and A6.4, A6.5 auto-fails; legal entities listed; CE Plus update retest rule
v3.2 · WillowApplications from 28 April 2025Passwordless recognised; ‘vulnerability fixes’ replaces ‘patches and updates’; plugins renamed extensions; CE Plus scope and sample verification
v3.1 · Montpellier24 April 2023Firmware in the software definition; asset management and BYOD; third-party devices; device unlocking; malware protection; zero trust

What should you re-check at renewal?

A renewal is a fresh self-assessment against the current question set, so last year's answers are a starting point, not a copy. Under Danzell, check these first:

  • A6.4 and A6.5: a No to either is an automatic fail, including router and firewall firmware.
  • A7.16 and A7.17: MFA for every administrator and user of every cloud service where it is offered, free or paid.
  • A2.9: every cloud service, including social media accounts. Cloud services cannot be excluded from scope.
  • A1.6 and A1.6.1: every additional legal entity covered by the certificate, which cannot be added after certification.
  • A2.6: Windows edition and feature version for every laptop and desktop, and any Windows 10 device enrolled in Extended Security Updates.

The auto-fail guide explains what to check for each of the five fail questions.

Related requirements

Frequently asked questions

Major releases have come roughly every one to two years. IASME's changelog in the Danzell question set records Evendine (November 2021), Montpellier (January 2023), Willow (September 2024) and Danzell (February 2026), each issued ahead of the date it took effect, with minor wording revisions in between.

The version in force when your assessment account is created. IASME applies Danzell and requirements v3.3 to accounts created after 26 April 2026. Accounts created before that date had six months to certify on the previous Willow set, a window that closed in late October 2026, so new assessments use Danzell.

No. IASME's terms say a certificate is valid for 12 months from the date of issue, whichever question set it was assessed on. You renew on whichever question set is current at the time of renewal, so read the change log before reusing last year's answers.

In the 'What's new in this version' list at the front of each NCSC requirements document, in the article IASME publishes before each annual update, and in the changelog sheet of each IASME question set. IASME's preview page also offers a comparison of the two most recent question sets. This log quotes the NCSC list verbatim and maps each change to the questions it touches.

Start with the five questions that carry fail wording: A6.4 and A6.5 on 14-day updates, and A7.15, A7.16 and A7.17 on MFA for every cloud service. Then re-list every cloud service in A2.9, because v3.3 says cloud services cannot be excluded from scope, and add every legal entity in scope to A1.6.1.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources