{
  "title": "Danzell question set analysis: what the 106 Cyber Essentials questions ask",
  "url": "https://cyberessentialspreparation.com/research/danzell-question-set-analysis",
  "publisher": "Precursor Security Ltd",
  "datePublished": "2026-09-22",
  "dateModified": "2026-09-22",
  "licence": "https://creativecommons.org/licenses/by/4.0/",
  "source": {
    "name": "IASME Cyber Essentials Danzell question set v16.3",
    "url": "https://iasme.co.uk/cyber-essentials/preview-the-self-assessment-questions-for-cyber-essentials/",
    "effectiveFrom": "2026-04-27"
  },
  "citation": "Precursor Security (2026). Danzell question set analysis: counts from the IASME Cyber Essentials Danzell question set v16.3. Cyber Essentials Preparation. https://cyberessentialspreparation.com/research/danzell-question-set-analysis (updated 22 September 2026).",
  "method": "https://cyberessentialspreparation.com/research/danzell-question-set-analysis#methodology",
  "totals": {
    "questions": 106,
    "numberedQuestions": 79,
    "subQuestions": 27,
    "organisationScopeInsurance": 44,
    "technicalControls": 62,
    "conditional": 17,
    "quoteCeRequirement": 48,
    "guidanceWords": 6387,
    "questionWords": 2231
  },
  "answerTypes": {
    "yesNo": 40,
    "notes": 54,
    "choice": 12,
    "choiceWithNotes": 7
  },
  "failWording": {
    "failOnNo": [
      "A6.4",
      "A6.5",
      "A7.16",
      "A7.17"
    ],
    "conditional": [
      "A7.15"
    ],
    "all": [
      "A6.4",
      "A6.5",
      "A7.15",
      "A7.16",
      "A7.17"
    ]
  },
  "sections": [
    {
      "prefix": "A1",
      "title": "Your organisation",
      "control": "Organisation, scope and insurance",
      "questions": 23,
      "numbered": 16,
      "subQuestions": 7,
      "yesNo": 6,
      "notes": 11,
      "choice": 6,
      "conditional": 3,
      "quoteCeRequirement": 0,
      "failWording": [],
      "url": "https://cyberessentialspreparation.com/questions/organisation"
    },
    {
      "prefix": "A2",
      "title": "Scope of assessment",
      "control": "Organisation, scope and insurance",
      "questions": 18,
      "numbered": 10,
      "subQuestions": 8,
      "yesNo": 1,
      "notes": 16,
      "choice": 1,
      "conditional": 4,
      "quoteCeRequirement": 0,
      "failWording": [],
      "url": "https://cyberessentialspreparation.com/questions/scope"
    },
    {
      "prefix": "A3",
      "title": "Insurance",
      "control": "Organisation, scope and insurance",
      "questions": 3,
      "numbered": 3,
      "subQuestions": 0,
      "yesNo": 1,
      "notes": 1,
      "choice": 1,
      "conditional": 0,
      "quoteCeRequirement": 0,
      "failWording": [],
      "url": "https://cyberessentialspreparation.com/questions/insurance"
    },
    {
      "prefix": "A4",
      "title": "Firewalls",
      "control": "Control 1: Firewalls",
      "questions": 14,
      "numbered": 11,
      "subQuestions": 3,
      "yesNo": 8,
      "notes": 5,
      "choice": 1,
      "conditional": 3,
      "quoteCeRequirement": 9,
      "failWording": [],
      "url": "https://cyberessentialspreparation.com/questions/firewalls"
    },
    {
      "prefix": "A5",
      "title": "Secure configuration",
      "control": "Control 2: Secure configuration",
      "questions": 10,
      "numbered": 10,
      "subQuestions": 0,
      "yesNo": 5,
      "notes": 3,
      "choice": 2,
      "conditional": 4,
      "quoteCeRequirement": 8,
      "failWording": [],
      "url": "https://cyberessentialspreparation.com/questions/secure-configuration"
    },
    {
      "prefix": "A6",
      "title": "Security update management",
      "control": "Control 3: Security updates",
      "questions": 16,
      "numbered": 7,
      "subQuestions": 9,
      "yesNo": 8,
      "notes": 8,
      "choice": 0,
      "conditional": 1,
      "quoteCeRequirement": 15,
      "failWording": [
        "A6.4",
        "A6.5"
      ],
      "url": "https://cyberessentialspreparation.com/questions/security-update-management"
    },
    {
      "prefix": "A7",
      "title": "User access control",
      "control": "Control 4: User access control",
      "questions": 17,
      "numbered": 17,
      "subQuestions": 0,
      "yesNo": 7,
      "notes": 10,
      "choice": 0,
      "conditional": 1,
      "quoteCeRequirement": 11,
      "failWording": [
        "A7.15",
        "A7.16",
        "A7.17"
      ],
      "url": "https://cyberessentialspreparation.com/questions/user-access-control"
    },
    {
      "prefix": "A8",
      "title": "Malware protection",
      "control": "Control 5: Malware protection",
      "questions": 5,
      "numbered": 5,
      "subQuestions": 0,
      "yesNo": 4,
      "notes": 0,
      "choice": 1,
      "conditional": 1,
      "quoteCeRequirement": 5,
      "failWording": [],
      "url": "https://cyberessentialspreparation.com/questions/malware-protection"
    }
  ],
  "controls": [
    {
      "number": 1,
      "title": "Firewalls",
      "prefix": "A4",
      "questions": 14,
      "cePlusTest": "Test 1: external vulnerability scan"
    },
    {
      "number": 2,
      "title": "Secure configuration",
      "prefix": "A5",
      "questions": 10
    },
    {
      "number": 3,
      "title": "Security updates",
      "prefix": "A6",
      "questions": 16,
      "cePlusTest": "Test 2: authenticated patch scan"
    },
    {
      "number": 4,
      "title": "User access control",
      "prefix": "A7",
      "questions": 17,
      "cePlusTest": "Test 4: MFA on cloud services; Test 5: account separation"
    },
    {
      "number": 5,
      "title": "Malware protection",
      "prefix": "A8",
      "questions": 5,
      "cePlusTest": "Test 3: malware protection tests"
    }
  ],
  "topicsInQuestionText": [
    {
      "topic": "Firewalls and routers",
      "matched": "firewall, router",
      "questions": 16,
      "ids": [
        "A2.5",
        "A4.1",
        "A4.1.1",
        "A4.1.2",
        "A4.2",
        "A4.2.1",
        "A4.3",
        "A4.4",
        "A4.5",
        "A4.6",
        "A4.7",
        "A4.9",
        "A4.11",
        "A6.1",
        "A6.4",
        "A6.4.2"
      ]
    },
    {
      "topic": "Cloud services",
      "matched": "cloud",
      "questions": 11,
      "ids": [
        "A2.6",
        "A2.9",
        "A5.1",
        "A5.2",
        "A6.3",
        "A6.3.1",
        "A7.6",
        "A7.14",
        "A7.15",
        "A7.16",
        "A7.17"
      ]
    },
    {
      "topic": "Passwords",
      "matched": "password",
      "questions": 11,
      "ids": [
        "A4.2",
        "A4.2.1",
        "A4.3",
        "A4.4",
        "A5.3",
        "A5.5",
        "A5.6",
        "A7.10",
        "A7.11",
        "A7.12",
        "A7.13"
      ]
    },
    {
      "topic": "Multi-factor authentication",
      "matched": "MFA, multi-factor",
      "questions": 9,
      "ids": [
        "A2.6",
        "A4.3",
        "A4.11",
        "A5.5",
        "A5.7",
        "A7.14",
        "A7.15",
        "A7.16",
        "A7.17"
      ]
    },
    {
      "topic": "Administrator accounts",
      "matched": "admin",
      "questions": 8,
      "ids": [
        "A5.3",
        "A7.2",
        "A7.5",
        "A7.6",
        "A7.7",
        "A7.8",
        "A7.9",
        "A7.16"
      ]
    },
    {
      "topic": "Supported or unsupported software",
      "matched": "supported",
      "questions": 6,
      "ids": [
        "A6.1",
        "A6.2",
        "A6.3",
        "A6.3.1",
        "A6.6",
        "A6.7"
      ]
    },
    {
      "topic": "The 14-day update window",
      "matched": "14 days",
      "questions": 4,
      "ids": [
        "A6.4",
        "A6.4.2",
        "A6.5",
        "A6.5.2"
      ]
    }
  ],
  "optionsMarkedAsChanged": [
    "A4.3",
    "A5.5"
  ],
  "changelog": [
    {
      "date": "March 2021",
      "version": "12",
      "details": "Initial release due to new release of NCSC CE requirements document"
    },
    {
      "date": "May 2021",
      "version": "12",
      "details": "Update to URL in A3.1"
    },
    {
      "date": "November 2021",
      "version": "13",
      "details": "Update to Evendine"
    },
    {
      "date": "January 2022",
      "version": "13",
      "details": "Size of organisation question removed"
    },
    {
      "date": "April 2022",
      "version": "13",
      "details": "A3.4 and A3.5 removed, business types updated, clarification to wording"
    },
    {
      "date": "January 2023",
      "version": "14",
      "details": "Updated to Montpellier"
    },
    {
      "date": "September 2024",
      "version": "15",
      "details": "Updated to Willow"
    },
    {
      "date": "January 2025",
      "version": "15.1",
      "details": "Minor wording changes to A2.1, A2.2 and A7.4; extended security update guidance added to A2.4 and A6.1"
    },
    {
      "date": "June 2025",
      "version": "15.2",
      "details": "Typos in answer types corrected"
    },
    {
      "date": "February 2026",
      "version": "16",
      "details": "Updated to Danzell"
    },
    {
      "date": "April 2026",
      "version": "16.1",
      "details": "Updates to section A1 around legal entities"
    },
    {
      "date": "April 2026",
      "version": "16.2",
      "details": "Updates to section A1 around legal entities"
    },
    {
      "date": "May 2026",
      "version": "16.3",
      "details": "Updated Crown logo, added title, corrected typo in A6.4.2"
    }
  ],
  "keyFindings": [
    "The IASME Danzell question set v16.3 contains 106 questions: 79 numbered questions and 27 sub-questions.",
    "Of the 106 questions in the IASME Danzell question set v16.3, 62 (58%) cover the five technical controls and 44 (42%) cover the organisation, scope and insurance.",
    "User access control (A7) is the largest of the five controls in the IASME Danzell question set v16.3 with 17 questions; malware protection (A8) is the smallest with 5.",
    "In the IASME Danzell question set v16.3, 54 of 106 questions (51%) are answered in a free-text notes field, 40 (38%) are yes or no, and 12 (11%) offer set options.",
    "In the IASME Danzell question set v16.3, 4 questions state in their guidance that a \"no\" fails the assessment: A6.4, A6.5, A7.16 and A7.17.",
    "All 5 questions with fail wording in the IASME Danzell question set v16.3 (A6.4, A6.5, A7.15, A7.16 and A7.17) sit in 2 sections: A6 security update management and A7 user access control.",
    "In the IASME Danzell question set v16.3, 48 of 106 questions (45%) quote the NCSC requirement they enforce under a \"CE Requirement\" label in the guidance.",
    "In the IASME Danzell question set v16.3, 17 of 106 questions are conditional and appear only when an earlier answer triggers them.",
    "Security update management (A6) has the most sub-questions of the five controls in the IASME Danzell question set v16.3: 9 of its 16 questions.",
    "The guidance in the IASME Danzell question set v16.3 runs to 6,387 words, 2.9 times the 2,231 words in the questions themselves.",
    "The changelog of the IASME Danzell question set v16.3 lists 13 revisions from March 2021 to May 2026, 4 of them in 2026."
  ]
}