Cyber Essentials question set 2026 (Danzell): every question explained
All 106 questions in the 2026 Cyber Essentials Danzell question set, sections A1 to A8, with the answer type, the auto-fail questions and a model answer for each.
The 2026 Cyber Essentials question set, named Danzell, has 106 questions in eight sections, answered in the IASME Pervade portal. A4 to A8 map to the five technical controls. Four questions fail automatically on a No, A7.15 fails if a listed service does offer MFA, and every notes question needs an evidenced answer.
- Questions
- 106 (40 Yes/No, 55 notes, 11 multiple choice)
- Sections
- A1 organisation, A2 scope, A3 insurance, A4 firewalls, A5 secure configuration, A6 security updates, A7 user access control, A8 malware protection
- Assessed against
- Requirements for IT Infrastructure v3.3
- Portal
- IASME Pervade portal, via your Certification Body
What are the eight sections of the question set?
The Danzell question set has eight sections: A1 your organisation, A2 scope, A3 insurance, then A4 to A8 for the five technical controls. Open a section for every question in it.
- Section A1Your organisation23 questionsA1.1 to A1.16Open section
- Section A2Scope of assessment18 questionsA2.1 to A2.10Open section
- Section A3Insurance3 questionsA3.1 to A3.3Open section
- Section A4Firewalls14 questionsA4.1 to A4.11Open section
- Section A5Secure configuration10 questionsA5.1 to A5.10Open section
- Section A6Security update management16 questionsA6.1 to A6.72 auto-failOpen section
- Section A7User access control17 questionsA7.1 to A7.173 auto-failOpen section
- Section A8Malware protection5 questionsA8.1 to A8.5Open section
Which questions are automatic fails?
Four questions fail automatically on a No answer: A6.4, A6.5, A7.16 and A7.17. A7.15 fails automatically if a cloud service you list there as having no MFA option does offer MFA. In each case the fail wording is in the IASME guidance text itself.
A6.3 and A6.6 (unlicensed or unsupported software) carry no fail wording in the question guidance, but IASME's FAQ says "any company using unsupported software in the scope of the assessment will fail to achieve Cyber Essentials certification". A Yes to A6.3 or a No to A6.6 is a fail until the software is removed, upgraded or moved into a sub-set. The supported software guides show what counts as supported.
- A6.4Are all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?Fails on a No answer
- A6.5Are all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release?Fails on a No answer
- A7.15If you have answered ‘No’ to question A7.14, please provide a list of your cloud services that do not provide any option for MFA.Fails if a cloud service listed there does offer MFA
- A7.16Has MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it?Fails on a No answer
- A7.17Has MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it?Fails on a No answer
What answer types does the question set use?
The question set uses three answer types: 40 Yes/No questions, 55 notes questions answered in free text, and 11 multiple choice questions. Some questions are conditional on earlier answers.
- Yes/No. A Yes must be true across the whole scope on the day you submit. The assessor reads it against your inventory and can return it for clarification, except on the auto-fail questions where a No is final.
- Notes. Free text. The assessor wants a process with an owner, a trigger and a record, in two to four sentences. Each question page on this site has a model answer template.
- Multiple choice. Organisation type, scope (whole or partial), the options A to E on firewall and external service authentication (A4.3, A5.5), brute force (A5.7) and malware protection (A8.1). Options D and E always require notes.
- Conditional questions. Some questions only appear depending on an earlier answer, for example A4.10 and A4.11 only if A4.9 is Yes. Each question page shows the logic.
Start with the highest-risk questions
- A6.4: critical updates within 14 daysAuto-fail
- A7.17: MFA for all cloud usersAuto-fail
- A2.9: listing cloud servicesCloud cannot be excluded
- A6.1: supported operating systemsWindows 10 and ESU
- Requirements overviewThe five controls
- What changed in 2026Danzell and v3.3
- Danzell question set analysisEvery question counted by type and control
- The question set as a downloadThe 2026 questions in one file
Frequently asked questions
106 in the 2026 Danzell set (v16.3), across eight sections: A1 your organisation, A2 scope, A3 insurance, A4 firewalls, A5 secure configuration, A6 security update management, A7 user access control and A8 malware protection. Some questions are conditional and only appear depending on earlier answers.
The name IASME gave the Cyber Essentials question set that came into force in April 2026, completed via the IASME Pervade portal. It assesses against Requirements for IT Infrastructure v3.3 and replaced the Willow set (v15), which assessed against v3.2. IASME's changelog records the update to Danzell as version 16 in February 2026, with 16.3, the current version, in May 2026.
Four questions fail automatically on a No answer (A6.4, A6.5, A7.16 and A7.17), and A7.15 fails automatically if a listed cloud service does offer MFA. A6.4 and A6.5 are the 14-day update rule; A7.15 to A7.17 concern MFA on cloud services. A6.3 and A6.6 (unsupported software) carry no fail wording, but a non-compliant answer means the licensed-and-supported requirement is not met.
Yes/No, notes (free text), and multiple choice, including the options A to E questions on firewall and external service authentication. Several Yes/No questions have a conditional notes follow-up, and options D and E always need notes.
An appropriate person, typically a director or board member with the associated legal authority, must validate every answer before submission. The attestation question at the end of the set asks for this, and IASME returns any submission that a board member has not validated.
Yes. IASME publishes the Danzell question set free of charge as a spreadsheet and PDF so applicants can prepare answers before entering them in the Pervade portal. This site reproduces every question with guidance and a model answer.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh