Check your readiness
v3.2 · Willow question set

Cyber Essentials changes April 2025: Willow question set and requirements v3.2

What changed in Cyber Essentials requirements v3.2 and the Willow question set from 28 April 2025: passwordless authentication, the vulnerability fixes wording, plugins renamed extensions, and the renamed CE Plus test specification.

Superseded
Updated 3 November 2026
Superseded
This version is no longer used for new assessments. The current version is v3.3 with the Danzell question set; read the 2026 changes.
Short answer

Cyber Essentials requirements v3.2 and the Willow question set applied to applications started from 28 April 2025. IASME called the changes fairly minor: passwordless authentication was recognised, 'patches and updates' became 'vulnerability fixes', 'plugins' became 'extensions', home working became home and remote working, and the CE Plus document dropped 'illustrative' and added scope verification.

Key facts
Requirements
Cyber Essentials: Requirements for IT Infrastructure v3.2, April 2025
Question set
Willow
Effective
Applications started on or after 28 April 2025
Superseded by
v3.3 and Danzell, 27 April 2026
Published
28 April 2025

What changed in Cyber Essentials v3.2?

Cyber Essentials v3.2 made 4 changes: passwordless authentication introduced; vulnerability fixes wording; CE Plus test specification renamed and scope verification added; definitions tidied: extensions, and home and remote working.

The items below summarise the version's changes, with the questions each touched.

  1. Passwordless authentication introduced

    Passwordless authentication was defined as 'an authentication method that uses a factor other than user knowledge to establish identity', with biometrics, security keys or tokens, one-time codes and push notifications as examples. v3.3 later added FIDO2 to the definition and stated that FIDO2 authenticators are regarded as MFA.

    QuestionsA4.3A5.5A7.11

  2. Vulnerability fixes wording

    'Patches and updates' became 'vulnerability fixes', defined as patches, updates, registry fixes, configuration changes, scripts or any other mechanism approved by the vendor. The 14-day rule applies to all of them.

    QuestionsA6.4AUTO-FAILA6.5AUTO-FAIL

  3. CE Plus test specification renamed and scope verification added

    The word 'illustrative' was dropped from the name. The assessor must verify that the Plus scope matches the self-assessment, that any sub-set is correctly segregated where the scope is not whole organisation, and that the device sample size was calculated with IASME's method. The Certification Body keeps the verification evidence for the lifetime of the certificate.

    QuestionsA2.1A2.2CE Plus sample size

  4. Definitions tidied: extensions, and home and remote working

    Under software, 'plugins' became 'extensions'. References to 'home working' became 'home and remote working', to cover staff working from cafes, hotels, trains and other shared spaces as well as from home.

    QuestionsA6.5AUTO-FAIL

When did Cyber Essentials v3.2 take effect?

Cyber Essentials v3.2 and the Willow question set took effect on 28 April 2025. It has since been superseded and is no longer used for new assessments.

Which questions changed in v3.2?

7 questions are affected by the v3.2 changes. Each links to its question page with the current wording and what a compliant answer looks like.

A2.1A2.2A4.3A5.5A6.4AUTO-FAILA6.5AUTO-FAILA7.11

Other versions and related pages

Frequently asked questions

Only for assessment accounts created on or before 26 April 2026, which were given six months to attain certification on it. The six months ran from the April 2026 change to late October 2026, so every assessment now is on Danzell.

Mainly terminology: passwordless authentication was added as an option, 'vulnerability fixes' replaced 'patches and updates', and the CE Plus document was renamed with scope verification added. The five controls were unchanged.

Yes. Certificates are valid for 12 months from issue regardless of the question set in force. Renewal will be on Danzell.

IASME's question set preview page still links the Willow question set and the v3.2 requirements for organisations that purchased before 27 April 2026. The current version is v3.3 and this site is written against it.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources