Cyber Essentials changed again in April 2026: what Danzell means for you

The state of play

Cyber Essentials is the UK government-backed scheme that certifies you have five basic technical controls in place. It is increasingly not optional: it is a condition of many public sector contracts, it turns up in supply chain questionnaires, and insurers ask about it.

The scheme is revised regularly. Version 3.2, known by its question set name Willow, came into force on 28 April 2025 and replaced Montpellier. From 27 April 2026, new assessment accounts move to v3.3, Danzell. Accounts created before the changeover may still be assessed under the previous requirements inside a transition window.

That transition window is the thing to check first, because it determines which set of questions you are actually answering this year.

What Willow changed, and why it still matters

Most businesses certifying now are feeling the Willow changes rather than anything newer. The substantive ones covered how multi-factor authentication is assessed, what counts as a vulnerability fix, and how cloud services are scoped.

The scoping change is the one that trips people up. Cloud services you use are in scope, including ones a department signed up for on a card without telling anyone. The question "what cloud services do we actually use" has a longer answer than most owners expect, and finding out during an assessment is an expensive way to discover it.

There are also auto-fail rules around security update management. Unpatched software with a known high-severity vulnerability is not a point deduction, it is a fail.

The five controls, in plain English

Underneath the version numbers the scheme has always asked the same five things, and they are all reasonable:

• Firewalls — something sits between your network and the internet, and it is configured, not just present
• Secure configuration — default passwords changed, unnecessary accounts and software removed
• User access control — people have the access they need and no more, admin accounts are separate, MFA is on
• Malware protection — it exists, it is turned on, and somebody would notice if it stopped
• Security update management — patches applied within 14 days for anything critical or high severity

If you are failing, it is almost always the last one. Patching is unglamorous, easy to defer and the single most common reason a certification falls over.

How to make reassessment boring

Do not treat it as an annual scramble. The businesses that pass easily are the ones where the controls are just how the estate runs, so the assessment is a description rather than a project.

Practically: keep an asset list that is actually current, including cloud services and personal devices used for work. Turn on automatic updates wherever you can and monitor the exceptions. Separate admin accounts from day-to-day accounts. Get MFA on everything that offers it. Then the questionnaire takes an afternoon instead of a fortnight.