Danzell is the Cyber Essentials question set that applies to assessment accounts created from 27 April 2026. It is version 3.3 of the requirements, and it replaces Willow, version 3.2. The five technical controls are still firewalls, secure configuration, security update management, user access control and malware protection. What changed is how strictly some of those questions are marked, and how clearly scope is defined.
If you already hold a certificate, it stays valid until it expires. The new questions matter when you open a new assessment account, or when a Willow account is still unfinished. Willow accounts opened before the change need to be completed by 26 October 2026. A Cyber Essentials Plus assessment follows the question set used for the self-assessment, and a Willow-based Plus assessment needs to be finished by 26 January 2027. Check the open date in the IASME portal rather than guessing from the expiry on the certificate.
What will fail an assessment outright?
Multi-factor authentication on cloud services is the change that catches the most organisations. Where the provider offers MFA, it has to be on for administrator accounts and for user accounts. One cloud service left without it is an automatic failure. “It costs extra” is not accepted as a reason. If a service genuinely has no MFA at all, that has to be checked and recorded, not assumed.
High-risk and critical security updates, including operating systems, applications and firewall or router firmware, still have to be applied within 14 days. Under Danzell, missing that window is an automatic failure, as is unsupported software that is still in scope. A tracker that says “we patch when we can” will not pass.
What now counts as in scope
A cloud service, for this scheme, is an on-demand service on shared infrastructure, reached over the internet with an account, that stores or processes your organisation’s data. That includes the obvious tools: email, file storage, accounting and the CRM. It also includes a business social media account where the platform holds organisational data and offers MFA. Cloud services cannot be left out of scope to make the assessment easier.
A FIDO2 security key or a passkey counts as MFA. One hardware key can meet the requirement. Password rules are unchanged in substance: longer passwords where MFA is not in use, and shorter ones where it is.
What to do before you book
List every cloud service that staff sign into with a work email. Turn MFA on for admins and users, including people who only work a few days a week. Export a patch report that shows high and critical updates applied inside 14 days. Retire or upgrade anything the vendor no longer supports. Then book the assessment. Cyber Root is an IASME-accredited Certification Body and can walk through the scope with you before the questions are submitted, which is cheaper than failing and starting again.