The Danzell question set is the 2026 Cyber Essentials self-assessment. It has 106 questions in sections A1 (organisation), A2 (scope), A3 (insurance) and A4 to A8 for the five controls. IASME publish it free as a PDF and spreadsheet so applicants can prepare answers, then paste them into the paid assessment portal.
Key takeaways
- The IASME Danzell question set v16.3 has 106 questions across sections A1 to A8 and applies to assessment accounts opened from 27 April 2026.
- 54 of the 106 questions are answered in a notes field, 40 are yes or no and 12 offer set options, per our Danzell question set analysis.
- The guidance under A6.4, A6.5, A7.16 and A7.17 says a no fails the assessment outright.
First sections
- 01A1 Your organisation: A1.1 to A1.16 with sub-questions, legal entity, size, reasons for applying
- 02A2 Scope of assessment: whole or partial, networks, devices, servers, mobiles, cloud services, IT owner
- 03A3 Insurance: eligibility and opt-in
- 04A4 Firewalls: A4.1 to A4.11 with sub-questions
- 05A5 Secure configuration: A5.1 to A5.10
- 06A6 Security update management: A6.1 to A6.7 with sub-questions, including the auto-fail patching questions
And 2 more, listed under what is inside.
- Format
- PDF and XLSX
- Access
- Free, links to the official PDF
- Who it is for
- Anyone preparing a self-assessment. Draft your answers in the spreadsheet before you buy portal access; IASME's FAQ gives you six months from application to submit.
- Sections
- 8
- Written against
- Requirements v3.3 (April 2026), Danzell question set
- Last updated
- 2026-11-03
IASME Cyber Essentials 2026 Danzell question set (v16.3)
Published by the NCSC or IASME. We link to the original rather than re-host it. Opens in a new tab.
Open the originalWhat is this document?
The self-assessment itself, published ahead of time on IASME's preview page as a PDF and an Excel spreadsheet, with a Welsh-language version and a comparison of the two most recent question sets. Each row has a question number, the question, guidance, an answer type (yes or no, multiple choice, or notes) and, where relevant, the logic that shows or hides it based on an earlier answer. The spreadsheet also carries a changelog sheet; version 16.3 is dated May 2026.
How do you use it to prepare?
- Download the Excel version, not the PDF, so you can write answers in a column beside each question.
- Fill in A2 first. The networks, devices and cloud services you list in A2.4 to A2.9 are the scope every later answer is checked against.
- Answer the five questions with fail wording (A6.4AUTO-FAIL, A6.5AUTO-FAIL, A7.15AUTO-FAIL, A7.16AUTO-FAIL, A7.17AUTO-FAIL) before anything else, and fix any gap they reveal.
- Write each notes answer as control, mechanism, owner and evidence. The notes field guide shows the pattern.
- Buy portal access only when the spreadsheet is complete. IASME's FAQ gives you six months from application to submit, and a short window to fix a fail.
How is it organised?
| Section | Questions | On this site |
|---|---|---|
| A1 Your organisation | A1.1 to A1.16 | Organisation |
| A2 Scope of assessment | A2.1 to A2.10 | Scope |
| A3 Insurance | A3.1 to A3.3 | Insurance |
| A4 Firewalls | A4.1 to A4.11 | Firewalls |
| A5 Secure configuration | A5.1 to A5.10 | Secure configuration |
| A6 Security update management | A6.1 to A6.7 | Security update management |
| A7 User access control | A7.1 to A7.17 | User access control |
| A8 Malware protection | A8.1 to A8.5 | Malware protection |
Every question has its own page in the question index, with the guidance text, what the assessor looks for and the common failure. For counts by section, control and answer type, with downloadable data, see the Danzell question set analysis.
Which questions should you read first?
A6.4AUTO-FAIL, A6.5AUTO-FAIL, A7.16AUTO-FAIL and A7.17AUTO-FAIL, because their guidance says a wrong answer fails the assessment outright. Then A2.6 to A2.9, because the device and cloud service lists are the scope that every later answer is checked against.
The question set is IASME's document and is not re-hosted here. The download page at IASME offers the PDF and the spreadsheet.
What is inside
| # | Section |
|---|---|
| 01 | A1 Your organisation: A1.1 to A1.16 with sub-questions, legal entity, size, reasons for applying |
| 02 | A2 Scope of assessment: whole or partial, networks, devices, servers, mobiles, cloud services, IT owner |
| 03 | A3 Insurance: eligibility and opt-in |
| 04 | A4 Firewalls: A4.1 to A4.11 with sub-questions |
| 05 | A5 Secure configuration: A5.1 to A5.10 |
| 06 | A6 Security update management: A6.1 to A6.7 with sub-questions, including the auto-fail patching questions |
| 07 | A7 User access control: A7.1 to A7.17, including the MFA auto-fails |
| 08 | A8 Malware protection: A8.1 to A8.5 |
Frequently asked questions
Yes. IASME says you can download the question set in advance, prepare your answers, then pay for access to the assessment portal and copy and paste your answers from the preparatory spreadsheet into it. Once you have applied, IASME's FAQ gives you six months to complete and submit the assessment.
The guidance says a 'no' to A6.4 and A6.5 is an automatic fail, that the assessment will fail on a 'no' to A7.16 or A7.17, and that listing a service in A7.15 that does have an MFA option is an automatic fail. A6.3 and A6.6 (unsupported software) carry no fail wording, but a non-compliant answer means the licensed-and-supported requirement is not met.
IASME's preview page offers two downloads: one for those who purchased before 27 April 2026 (Willow) and one for those purchasing from that date (Danzell). Accounts created before the change were given six months to certify on Willow, so every new assessment now uses Danzell.
Yes. IASME's preview page links a Welsh-language version of the Danzell question set, and the NCSC publishes Welsh translations of the Requirements v3.3 and the Cyber Essentials Plus test specification.
When the NCSC revises the requirements. IASME issues a new named set ahead of the date it takes effect, and point releases fix wording in between: the spreadsheet changelog shows Danzell issued in February 2026 and in force from 27 April 2026 with Requirements v3.3. The change log on this site records what changed and when.
More from the library
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh
- IASMEIASME, Cyber Essentials Danzell Question Set 2026 (v16.3)Read on iasme.co.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials frequently asked questionsRead on iasme.co.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)