The 2026 Danzell Cyber Essentials question set (v16.3) has 106 questions: 44 on the organisation, scope and insurance and 62 across the five technical controls. Of those, 54 are answered in a notes field and 40 are yes or no. A "no" to A6.4, A6.5, A7.16 or A7.17 fails the assessment.
- Questions
- 106
- 79 numbered, 27 sub-questions
- Notes-field answers
- 51%
- 54 of 106 questions
- Questions with fail wording
- 5
- All in A6 and A7
- Conditional questions
- 17
- Shown only after a trigger answer
- In force from
- 27 April 2026, alongside NCSC Requirements for IT Infrastructure v3.3
- Records counted
- 106 questions, every row in the question-set sheet
- Data
- JSON · CSV by section · CSV by question
- Last updated
- 2026-09-22
What are the key findings?
Each finding below stands on its own and names its source, so it can be quoted without the rest of the page.
- 01The IASME Danzell question set v16.3 contains 106 questions: 79 numbered questions and 27 sub-questions.
- 02Of the 106 questions in the IASME Danzell question set v16.3, 62 (58%) cover the five technical controls and 44 (42%) cover the organisation, scope and insurance.
- 03User access control (A7) is the largest of the five controls in the IASME Danzell question set v16.3 with 17 questions; malware protection (A8) is the smallest with 5.
- 04In the IASME Danzell question set v16.3, 54 of 106 questions (51%) are answered in a free-text notes field, 40 (38%) are yes or no, and 12 (11%) offer set options.
- 05In the IASME Danzell question set v16.3, 4 questions state in their guidance that a "no" fails the assessment: A6.4, A6.5, A7.16 and A7.17.
- 06All 5 questions with fail wording in the IASME Danzell question set v16.3 (A6.4, A6.5, A7.15, A7.16 and A7.17) sit in 2 sections: A6 security update management and A7 user access control.
- 07In the IASME Danzell question set v16.3, 48 of 106 questions (45%) quote the NCSC requirement they enforce under a "CE Requirement" label in the guidance.
- 08In the IASME Danzell question set v16.3, 17 of 106 questions are conditional and appear only when an earlier answer triggers them.
- 09Security update management (A6) has the most sub-questions of the five controls in the IASME Danzell question set v16.3: 9 of its 16 questions.
- 10The guidance in the IASME Danzell question set v16.3 runs to 6,387 words, 2.9 times the 2,231 words in the questions themselves.
- 11The changelog of the IASME Danzell question set v16.3 lists 13 revisions from March 2021 to May 2026, 4 of them in 2026.
How many questions are in each section?
The set runs from A1 to A8. A1 to A3 describe the organisation, what is in scope and whether it wants the included insurance. A4 to A8 are the five technical controls in the order the NCSC requirements document gives them. A1 your organisation is the largest section with 23 questions, because it collects legal-entity and application details.
| Section | Questions | Sub | Yes/No | Notes | Choice | Conditional |
|---|---|---|---|---|---|---|
| A1 Your organisation | 23 | 7 | 6 | 11 | 6 | 3 |
| A2 Scope of assessment | 18 | 8 | 1 | 16 | 1 | 4 |
| A3 Insurance | 3 | 0 | 1 | 1 | 1 | 0 |
| A4 Firewalls | 14 | 3 | 8 | 5 | 1 | 3 |
| A5 Secure configuration | 10 | 0 | 5 | 3 | 2 | 4 |
| A6 Security update management | 16 | 9 | 8 | 8 | 0 | 1 |
| A7 User access control | 17 | 0 | 7 | 10 | 0 | 1 |
| A8 Malware protection | 5 | 0 | 4 | 0 | 1 | 1 |
| Total | 106 | 27 | 40 | 54 | 12 | 17 |
How many questions map to each of the five controls?
62 of the 106 questions (58%) test the five technical controls. User access control and security update management together account for 33 questions, and they are also the only two controls whose guidance contains fail wording. The Cyber Essentials Plus test column shows which NCSC test case checks each control on the audit.
| Control | Section | Questions | Share of 106 | CE Plus test | Fail wording |
|---|---|---|---|---|---|
| 1. Firewalls | A4 | 14 | 13% | Test 1: external vulnerability scan | None |
| 2. Secure configuration | A5 | 10 | 9% | None | |
| 3. Security updates | A6 | 16 | 15% | Test 2: authenticated patch scan | A6.4AUTO-FAILA6.5AUTO-FAIL |
| 4. User access control | A7 | 17 | 16% | Test 4: MFA on cloud services; Test 5: account separation | A7.15AUTO-FAILA7.16AUTO-FAILA7.17AUTO-FAIL |
| 5. Malware protection | A8 | 5 | 5% | Test 3: malware protection tests | None |
How are the questions answered?
The spreadsheet gives every question an answer type. Normalised to three kinds, 54 questions (51%) take a free-text notes answer, 40 (38%) take yes or no, and 12 (11%) offer a set of options, 7 of which also ask for notes. Notes answers are where assessors raise most queries, which is why the notes-field guide exists.
Two option questions record a change in the answer-type column itself: A4.3 and A5.5 note that option D is now passwordless and that a new option E, none of the above, has been added.
| Answer type | Questions | Share |
|---|---|---|
| Notes (free text) | 54 | 51% |
| Yes or no | 40 | 38% |
| Choice (options, some with notes) | 12 | 11% |
Which questions fail the assessment outright?
5 questions carry fail wording in their own guidance: the phrase "automatic fail" or "the assessment will fail". 4 of them fail on a "no". The other, A7.15, fails if you list a cloud service as having no MFA option when it does offer one. Every one of them is in A6 or A7.
| Question | What it asks | What fails |
|---|---|---|
| A6.4AUTO-FAIL | Are all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release? | A "no" answer |
| A6.5AUTO-FAIL | Are all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release? | A "no" answer |
| A7.15AUTO-FAIL | If you have answered ‘No’ to question A7.14, please provide a list of your cloud services that do not provide any option for MFA. | Listing a cloud service that does offer MFA |
| A7.16AUTO-FAIL | Has MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it? | A "no" answer |
| A7.17AUTO-FAIL | Has MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it? | A "no" answer |
A6.3 and A6.6 (unlicensed or unsupported software) carry no fail wording in the question guidance, but IASME's FAQ is explicit: "Any company using unsupported software in the scope of the assessment will fail to achieve Cyber Essentials certification." Treat a Yes to A6.3 or a No to A6.6 as a fail. The supported software guides show what counts as supported, and the guide to the answers that fail covers all five automatic fails.
Which topics do the questions name most often?
A case-insensitive search of the question text (not the guidance) for each term. A question can match more than one topic. Firewalls and routers lead because the A4 questions name the device in almost every line.
| Topic | Matched | Questions |
|---|---|---|
| Firewalls and routers | firewall, router | 16 |
| Cloud services | cloud | 11 |
| Passwords | password | 11 |
| Multi-factor authentication | MFA, multi-factor | 9 |
| Administrator accounts | admin | 8 |
| Supported or unsupported software | supported | 6 |
| The 14-day update window | 14 days | 4 |
How often has the question set changed?
The spreadsheet's changelog lists 13 revisions from March 2021 to May 2026, 4 of them in 2026. Named releases (Evendine, Montpellier, Willow, Danzell) track a new NCSC requirements version; the point releases in between fix wording, typos and legal-entity handling. The rows below are transcribed from the sheet, not computed.
| Date | Version | Change |
|---|---|---|
| May 2026 | 16.3 | Updated Crown logo, added title, corrected typo in A6.4.2 |
| April 2026 | 16.2 | Updates to section A1 around legal entities |
| April 2026 | 16.1 | Updates to section A1 around legal entities |
| February 2026 | 16 | Updated to Danzell |
| June 2025 | 15.2 | Typos in answer types corrected |
| January 2025 | 15.1 | Minor wording changes to A2.1, A2.2 and A7.4; extended security update guidance added to A2.4 and A6.1 |
| September 2024 | 15 | Updated to Willow |
| January 2023 | 14 | Updated to Montpellier |
| April 2022 | 13 | A3.4 and A3.5 removed, business types updated, clarification to wording |
| January 2022 | 13 | Size of organisation question removed |
| November 2021 | 13 | Update to Evendine |
| May 2021 | 12 | Update to URL in A3.1 |
| March 2021 | 12 | Initial release due to new release of NCSC CE requirements document |
How was this analysis done?
The source is the IASME Cyber Essentials Danzell v16.3 question set spreadsheet, effective 27 April 2026, downloaded from IASME and held in this site's repository. Each question row was extracted into a structured file with its number, section, question text, guidance, answer type and question logic. The page, the downloads and the facts in llms.txt are all computed from that file when the site is built, so the figures cannot drift from each other.
- Question: every row with a question number, A1.1 to A8.5. A sub-question has three number parts (A6.4.1). Section header rows and guidance continuation rows are not questions.
- Technical control: sections A4 to A8, matched to the five NCSC controls. A1 to A3 are counted as organisation, scope and insurance.
- Answer type: "Yes/No" exactly is yes or no; "Notes" exactly is notes; any other value, which in every case offers options, is choice.
- Conditional: the Question Logic column is not empty.
- Quotes a requirement: the guidance contains the label "CE Requirement".
- Fail wording: the guidance contains "automatic fail" or "assessment will fail". Fails on a "no" when followed by "if the answer is no".
- Topics: case-insensitive match in the question text on firewall, router; cloud; password; MFA, multi-factor; admin; supported; 14 days.
- Word counts: whitespace-separated tokens in the question and guidance columns.
Limits: the analysis describes the question set as published. It says nothing about how often any question is failed in practice; neither IASME nor Precursor publishes pass rates by question. Percentages are rounded to the nearest whole number.
How should you cite this analysis?
Quote the finding with its number, link to this page, and give the date it was last updated. The source for every figure is the IASME question set, so name it too.
Precursor Security (2026). Danzell question set analysis: counts from the IASME Cyber Essentials Danzell question set v16.3. Cyber Essentials Preparation. https://cyberessentialspreparation.com/research/danzell-question-set-analysis (updated 22 September 2026).
- Canonical URL
- https://cyberessentialspreparation.com/research/danzell-question-set-analysis
- Last updated
Can you download the data?
Yes. The files are generated from the same data as this page and are published under CC BY 4.0: reuse them freely with attribution to this page.
Read next
Frequently asked questions
The IASME Danzell question set v16.3, in force from 27 April 2026, contains 106 questions: 79 numbered questions and 27 sub-questions across sections A1 to A8. Not every applicant sees all of them, because 17 are conditional on an earlier answer.
In the Danzell guidance text, a "no" to A6.4, A6.5, A7.16, A7.17 fails the assessment. A7.15 also carries fail wording: listing a cloud service there that does offer MFA is an automatic fail. All 5 sit in security update management (A6) and user access control (A7).
54 of the 106 questions (51%) are answered only in a free-text notes field, and 7 of the 12 option questions also ask for notes. 40 questions (38%) are a plain yes or no.
User access control (A7) has 17 questions, the most of the five controls. Security update management (A6) has 16, firewalls (A4) 14, secure configuration (A5) 10 and malware protection (A8) 5.
Yes, with attribution. Cite the canonical URL of this page and the date it was last updated, and name the IASME Danzell question set v16.3 as the underlying source. The counts are also available as JSON and CSV.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh
- IASMEIASME Cyber Essentials Danzell question set v16.3 · effective 27 April 2026Read on iasme.co.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials Plus Test Specification v3.2Read on ncsc.gov.uk (opens in a new tab)