Check your readiness
v3.3 · Danzell question set

Cyber Essentials changes April 2026: Danzell question set and requirements v3.3

Every change in Cyber Essentials requirements v3.3 and the Danzell question set: the six NCSC what's new items, the new auto-fail questions, and the IASME scope, certificate and CE Plus changes from 27 April 2026.

Current version
Updated 3 November 2026
Short answer

Cyber Essentials requirements v3.3 and the Danzell question set apply to assessment accounts created from 27 April 2026. The NCSC lists six changes: cloud services defined, passwordless includes FIDO2, cloud services cannot be excluded, the Software Security Code of Practice referenced, 'untrusted connections' wording removed, and backups emphasised. Four questions now fail automatically on a No.

Key facts
Requirements
Cyber Essentials: Requirements for IT Infrastructure v3.3, April 2026
Question set
Danzell, v16.3 (May 2026), completed in the IASME assessment portal
Effective
Assessment accounts created after 26 April 2026, so from 27 April; accounts created earlier have six months to certify on Willow
Auto-fails
A6.4, A6.5 (14-day critical updates) and A7.16, A7.17 (MFA on cloud services) fail on a No; A7.15 fails if a listed service does offer MFA
IASME fee
£320 to £600 plus VAT by organisation size (checked 3 November 2026)
Published
27 April 2026

What changed in Cyber Essentials v3.3?

Cyber Essentials v3.3 made 6 changes: definition for cloud services provided; updated definition for Passwordless Authentication to include FIDO2; definitive statement that cloud services cannot be excluded from scope; software Security Code of Practice introduced in Software Development section; scope criteria no longer refers to untrusted connections; importance of backing up data is emphasised.

The six items below are quoted from the 'What's new in this version' list at the front of the NCSC document, followed by our reading of each and the questions it touches.

  1. NCSC wording

    Definition for ‘cloud services’ provided

    Section B now defines a cloud service as an on-demand, scalable service, hosted on shared infrastructure, and accessible via the internet, accessed via an account and storing or processing data for your organisation. The definition is repeated in A7.14, and the A2.9 guidance adds that social media accounts count.

    QuestionsA2.9A7.14Glossary: cloud service

  2. NCSC wording

    Updated definition for Passwordless Authentication to include FIDO2

    Passwordless authentication is a method to establish a user's identity that uses a factor other than knowledge, and the examples now name FIDO2 authenticators. In the User Access Control section, FIDO2 authenticators are regarded as MFA because user authentication is performed. Option D in A4.3 and A5.5 is 'passwordless' and needs a notes description.

    QuestionsA4.3A5.5A7.10A7.11Glossary: passwordless authentication

  3. NCSC wording

    Definitive statement that cloud services cannot be excluded from scope

    Section D states that if your organisation's data or services are hosted on cloud services, these services must be in scope, and that cloud services cannot be excluded from scope. A2.9 repeats the sentence at the point where you list them.

    QuestionsA2.1A2.2A2.9Cloud services scope

  4. NCSC wording

    Software Security Code of Practice introduced in Software Development section

    Section D(vii) still says publicly available commercial web applications are in scope by default and bespoke components are out, and now refers applicants to the Software Security Code of Practice for 'robust development and testing'. No new question was added.

    QuestionsA5.4Software development scope

  5. NCSC wording

    Scope criteria no longer refers to ‘untrusted connections'

    The three scope conditions are now phrased around devices that can accept incoming connections from internet-connected devices, can establish outbound connections via the internet, or control the flow of data between those devices and the internet. The old 'untrusted connections' wording is gone, which removes the argument that a device behind a trusted link is out of scope.

    QuestionsA2.4A2.5Scope overview

  6. NCSC wording

    Importance of backing up data is emphasised

    Section C, Backing up your data, keeps backups as not a technical requirement but highly recommended, with practical advice on regular and automatic backups and disconnecting USB drives. No question assesses it.

    Backups and Cyber Essentials

When did Cyber Essentials v3.3 take effect?

Cyber Essentials v3.3 and the Danzell question set took effect on 27 April 2026. It is the current version, and every new assessment is marked against it. IASME applies the change by account creation date: accounts created after 26 April 2026 use Danzell and v3.3, and accounts created earlier had six months to certify on Willow. IASME's FAQ gives six months from application to complete and submit, and its preview page offers both question sets so you can check which one your account uses.

What did IASME change in how Danzell is marked?

IASME made 7 operational changes alongside the NCSC document, covering how the Danzell question set is marked and how certificates are issued.

  • Effective for assessment accounts created after 26 April 2026

    IASME's February 2026 update says the changes apply to all assessment accounts created after 26 April 2026. Any organisation with an active account created before that date had six months to attain certification on the previous version, the Willow question set. New accounts go straight to Danzell.

  • No MFA on a cloud service where it is available is an automatic fail

    MFA is mandatory for every cloud service where it is available, and IASME says this applies whether MFA is free, included or a paid option. Not implementing it fails the assessment, which the Danzell guidance writes into A7.16 and A7.17.

    QuestionsA7.14A7.15AUTO-FAILA7.16AUTO-FAILA7.17AUTO-FAILUser access control

  • Two security update questions became automatic fails

    A6.4 (operating systems and router and firewall firmware) and A6.5 (applications, including associated files and extensions) are designated auto-fail questions: a No fails the assessment regardless of the other answers, because a critical or high-risk fix was not installed within 14 days.

    QuestionsA6.4AUTO-FAILA6.5AUTO-FAILThe 14-day rule in practice

  • Scope descriptions on the certificate are no longer limited in length

    You can give a detailed scope description, viewable on the digital certificate platform. Where the scope is partial, out-of-scope areas must also be described, and that information is not made public.

    QuestionsA2.2A2.2.1

  • Every legal entity in scope is listed

    A1.6 and A1.6.1 capture each additional legal entity covered, with name, company number and registered address. Each is listed on the primary entity's digital certificate and in the certificate search, and separate certificates for each entity cost £10. If the primary certificate is revoked, the included entities' certificates are revoked too.

    QuestionsA1.6A1.6.1

  • ‘Point in time’ is the certificate issue date

    Systems must be supported at the date of certification, and the declaration signed by a board member or director now acknowledges responsibility for maintaining compliance with all the controls throughout the certification period.

  • CE Plus update management retest and revocation rule; self-assessment answers locked once CE Plus starts

    Under 'Verification of update management compliance', a sample that fails on updates is remediated and retested on the original sample plus a new random sample, and a second failure revokes the verified self-assessment certificate. IASME gives the reason: some organisations updated only the devices sampled for the audit. The verified self-assessment must also be completed, finalised and unchanged before CE Plus testing starts, so the scope and answers must be right first time.

    QuestionsA6.4AUTO-FAILA6.5AUTO-FAILCE Plus pass and fail rulesTest 2: authenticated patch scan

Which questions changed in v3.3?

19 questions are affected by the v3.3 changes. Each links to its question page with the current wording and what a compliant answer looks like.

A1.6A1.6.1A2.1A2.2A2.2.1A2.4A2.5A2.9A4.3A5.4A5.5A6.4AUTO-FAILA6.5AUTO-FAILA7.10A7.11A7.14A7.15AUTO-FAILA7.16AUTO-FAILA7.17AUTO-FAIL

Which questions are automatic fails under Danzell?

5 questions carry automatic-fail wording under Danzell: A6.4, A6.5, A7.15, A7.16, A7.17. In the guidance text, a No to A6.4, A6.5, A7.16 or A7.17 fails the assessment outright, and A7.15 fails automatically if a cloud service listed there does offer MFA. That answer fails the whole self-assessment, whatever the other answers say.

This list follows the fail wording in the Danzell v16.3 guidance text. IASME's February 2026 update describes the MFA auto-fail policy and the designation of A6.4 and A6.5 as auto-fail questions as part of the April 2026 changes. A6.3 and A6.6 (unsupported software) carry no fail wording, but a non-compliant answer means the requirement that all software on in-scope devices must be licensed and supported is not met, and IASME's FAQ says any company using unsupported software in scope will fail to achieve certification.

Automatic fails under this version

  1. A6.4Are all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?Fails on a No answer
  2. A6.5Are all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release?Fails on a No answer
  3. A7.15If you have answered ‘No’ to question A7.14, please provide a list of your cloud services that do not provide any option for MFA.Fails if a cloud service listed there does offer MFA
  4. A7.16Has MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it?Fails on a No answer
  5. A7.17Has MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it?Fails on a No answer

Other versions and related pages

Frequently asked questions

27 April 2026. IASME applies the changes to assessment accounts created after 26 April 2026, which use the Danzell question set and requirements v3.3. Accounts created earlier were given six months to attain certification on the previous Willow set, so that window closed in late October 2026.

Four questions fail automatically on a No answer: A6.4 and A6.5, critical or high-risk updates within 14 days for operating systems and applications, and A7.16 and A7.17, MFA on all cloud administrators and all cloud users. A7.15 fails automatically if a listed cloud service does offer MFA. IASME announced the MFA and A6.4 and A6.5 auto-fails as part of the April 2026 changes.

IASME's published self-assessment fees, checked on 3 November 2026, are £320 (0 to 9 staff), £440 (10 to 49), £500 (50 to 249) and £600 (250 and over), plus VAT. IASME is also running a government-funded 75% discount for UK micro and SME organisations that have not held Cyber Essentials in the last four years, if they register and purchase by 31 March 2027.

The five controls and their thresholds are the same. The changes are definitional (cloud service, passwordless and FIDO2), scoping (cloud cannot be excluded, untrusted connections wording removed) and emphasis (backups, Software Security Code of Practice). The harder edge is in marking: the Danzell guidance states outright that a No to A6.4, A6.5, A7.16 or A7.17 fails the assessment.

No. v3.3 makes the definitive statement that cloud services cannot be excluded from scope. Every third-party cloud service holding or processing your data is listed in A2.9 and must have MFA enforced where available.

Only with the Microsoft Extended Security Update programme. The A2.6 and A6.1 guidance says that if you are using Windows 10 beyond 14 October 2025 you must be signed up to it to remain compliant, and that for any end-of-life operating system with an extended security update programme you must maintain the subscription. Otherwise Windows 10 is unsupported software and the application will not pass.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources