Question set versions
Question set versions are the named releases of the Cyber Essentials question set, which IASME updates when the NCSC revises the requirements. IASME's changelog records Evendine (2021), Montpellier (2023), Willow (2024) and Danzell (2026). Danzell, v16.3, is current and assesses against requirements v3.3. Willow is superseded and should not be used for new answers.
- Term
- Question set versions
- Also known as
- Evendine, Montpellier, Willow, Danzell
- Category
- Scheme and certification
- Requirement area
- Scheme vocabulary
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term question set versions mean in Cyber Essentials?
Question set versions are the named releases of the Cyber Essentials question set, which IASME updates when the NCSC revises the requirements.
How does question set versions apply to Cyber Essentials?
In plain terms. Like editions of a textbook, each version keeps most of the old questions and changes the ones where the rules moved. The names carry no meaning of their own. They are labels so everyone knows which edition applies.
The versions on record. The changelog inside the Danzell spreadsheet lists the named releases:
| Name | Question set version | Changelog date |
|---|---|---|
| Evendine | 13 | November 2021 |
| Montpellier | 14 | January 2023 |
| Willow | 15 | September 2024 |
| Danzell | 16, now 16.3 | February 2026 |
Point releases in between, such as 15.1 and 16.3, fix wording and typos. The changelog dates are when IASME revised the spreadsheet, not when each set took effect: each named set was issued ahead of its effective date, so Willow, revised in September 2024, applied alongside Requirements v3.2 from April 2025. Danzell applies to assessment accounts opened from 27 April 2026 and pairs with the NCSC Requirements for IT Infrastructure v3.3. Willow paired with v3.2 and Montpellier with v3.1.
What to watch. A renewal uses whichever question set is current when you apply, and an issued certificate stays valid for its full term when a new version arrives. Before reusing old answers, read what changed. Requirements v3.3, which Danzell assesses against, added a definition of cloud services and states that cloud services cannot be excluded from scope.
See the change log, what changed in 2026 and the Danzell question set.
Related terms
- Danzell question setThe Danzell question set is the current list of questions every Cyber Essentials applicant answers, published by IASME and used for assessments from 27 April 2026.
- Re-markA re-mark is a second marking of a failed Cyber Essentials self-assessment after the applicant has corrected the answers.
- RecertificationRecertification is the yearly renewal of Cyber Essentials, done by completing a full new self-assessment before the current certificate expires.
- RemediationRemediation is the work of fixing security gaps, such as replacing unsupported software or turning on MFA, so a control meets the standard.
- Requirements for IT InfrastructureCyber Essentials: Requirements for IT Infrastructure is the NCSC document that sets out exactly what an organisation must do to meet Cyber Essentials.
- RetestA retest is a repeat of failed Cyber Essentials Plus tests, carried out after the organisation has fixed the problems the assessor found.
Frequently asked questions
Question set versions are the named releases of the Cyber Essentials question set, which IASME updates when the NCSC revises the requirements.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.