If your business renews Cyber Essentials this year, the questions have changed. IASME released a new question set called Danzell, alongside version 3.3 of the requirements. It applies to assessment accounts opened from 26 April 2026, with a six month transition for accounts that already existed.
Most of the controls stay the same. What has changed is how strictly some of them are marked.
1. MFA on cloud services is now an automatic fail
Multi-factor authentication is mandatory on every cloud service that offers it. If you have one account without MFA, such as an old shared mailbox or a supplier portal, you fail. Check every cloud service your staff log into, not only Microsoft 365 or Google Workspace.
2. Cloud services cannot be left out of scope
The requirements now define a cloud service clearly and state that cloud services cannot be excluded. If your business uses it and it holds your data, it is in.
3. Missing the 14 day update window is an automatic fail
Critical and high risk updates for operating systems, firmware and applications must be applied within 14 days of release. Firmware on routers, firewalls and printers is easy to forget.
4. Your scope description needs more detail
You now describe what is in scope and what is not, and name each legal entity with its address and company number. Groups can request a separate certificate for each legal entity for a small fee.
5. Cyber Essentials Plus is stricter on updates
If devices fail the update test during a Plus audit, the assessor retests on a fresh sample. A second failure revokes your basic certificate. You also cannot change your self-assessment answers once Plus testing has started.
What to do now. list every cloud service you use and confirm MFA on each, check your update process hits 14 days including firmware, and write down what is in and out of scope before you open your assessment.
Want a second pair of eyes before you submit? Book a free 30 minute call.
Still not sure what this means for you?
Send me one quick question about your own setup and I'll give you a plain English answer, usually within one working day.