Danzell question set
The Danzell question set is the current list of questions every Cyber Essentials applicant answers, published by IASME and used for assessments from 27 April 2026. The current revision is v16.3. It assesses against the NCSC Requirements for IT Infrastructure v3.3, and four questions fail automatically on a No answer: A6.4, A6.5, A7.16 and A7.17.
- Term
- Danzell question set
- Also known as
- Danzell, 2026 Cyber Essentials question set, question set v16.3
- Category
- Scheme and certification
- Requirement area
- Scheme vocabulary
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term Danzell question set mean in Cyber Essentials?
The Danzell question set is the current list of questions every Cyber Essentials applicant answers, published by IASME and used for assessments from 27 April 2026.
How does Danzell question set apply to Cyber Essentials?
In plain terms
Danzell is the exam paper. IASME gives each new version a name, much as software releases get code names, so applicants and assessors know which paper is being sat. Danzell replaced Willow and is the set used for all assessment accounts opened from 27 April 2026.
What it contains
The set is organised into sections A1 to A8. A1 asks about your organisation, A2 defines your scope, A3 covers the included cyber insurance, and A4 to A8 follow the five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. It closes with an attestation that a board-level person has validated the answers. Most technical questions quote the matching "CE Requirement" from the NCSC text in their guidance. You answer in the IASME Pervade portal, and IASME publishes the set as a spreadsheet and PDF so you can prepare your answers first.
Common mistakes
Reusing last year's answers without checking what changed. Answering Yes to A6.4 or A6.5 on the strength of a policy when updates are not actually installed within 14 days: the guidance says "If you cannot achieve this requirement at all times, you will not achieve compliance to this question." And listing a cloud service at A7.15 as having no MFA option when it does have one, which is also an automatic fail.
See the question index, the Danzell question set resource and question set versions.
Related terms
- ScopeScope is the networks, hardware and software assets, and cloud services that are included in a Cyber Essentials assessment.
- Question set versionsQuestion set versions are the named releases of the Cyber Essentials question set, which IASME updates when the NCSC revises the requirements.
- Def Stan 05-138Def Stan 05-138 is the Ministry of Defence standard setting the cyber security controls defence suppliers must meet, graded by contract risk.
- DSPT (Data Security and Protection Toolkit)The DSPT, or Data Security and Protection Toolkit, is the NHS's annual online self-assessment for organisations that have access to NHS patient data and systems.
- EvidenceEvidence is any record, screenshot, report or document that shows a security control described in your Cyber Essentials answers is really in place.
- Gap analysisA gap analysis is a review of your IT against the Cyber Essentials requirements before you apply, listing each gap and how to close it.
Frequently asked questions
The Danzell question set is the current list of questions every Cyber Essentials applicant answers, published by IASME and used for assessments from 27 April 2026.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.