What Are The Upcoming Changes to Cyber Essentials?

The cybersecurity landscape is shifting, and the UK’s leading certification is moving with it. On 27 April 2026, the National Cyber Security Centre (NCSC) and IASME will launch the latest version of Cyber Essentials, known as the Danzell question set (V3.3). 

At Systemagic, we believe in staying ahead of the curve. These changes are designed to close the gaps that attackers exploit most often, particularly around cloud services and patching speeds. 

Here is everything you need to know about the transition and how it affects your next certification.

Key Dates and the Transition Period

If your certification is due around April, timing is everything. 

• Before 27 April 2026: Any assessment account created will follow the current “Willow” question set. 

• From 27 April 2026: All new accounts automatically move to the Danzell requirements. 

• The Grace Period: If you start your application before the April deadline, you have a six-month window to complete your certification under the old rules.

The “Auto-Fail” Criteria: MFA and Patching

The most significant change is the introduction of “Stricter Marking.” In previous years, some minor gaps might have been flagged for later; under Danzell, they are automatic failures. 

• MFA for Cloud Services: Multi-Factor Authentication is no longer just “recommended”, it is mandatory for all cloud services where it is available. This includes SaaS platforms, social media, and financial portals. If the service offers MFA (even as a paid upgrade), you must have it enabled for all users. 
• The 14-Day Patching Rule: High-risk and critical updates for Operating Systems, firmware, and applications must be applied within 14 days of release. Under Danzell, failing to prove this will trigger an immediate failure of the assessment.

Transparency and Scoping

Scoping has always been the most complex part of Cyber Essentials. The 2026 update aims for total clarity. 

• No Cloud Exclusions: You can no longer exclude cloud services from your scope if they process or store organisational data. 

• Detailed Evidence: You will be required to provide more granular detail on legal entities, networks, and specifically why certain areas are excluded. 

• “Point-in-Time” Compliance: The NCSC has clarified that compliance is measured on the date the certificate is issued. You must be compliant when you cross the finish line, not just when you started the paperwork.

Enhancements to Cyber Essentials Plus

For those undergoing the technical audit (CE+), the bar has been raised to prevent “selective fixing.” 

• Randomised Retesting: If a device fails a scan, you can’t just fix that one laptop. The assessor will now pick a new random sample of devices for the retest to ensure your patching processes are working across the entire company. 

• Locked Assessments: Once the CE+ technical audit begins, you can no longer amend your self-assessment answers. It is vital to get the “Basic” portion 100% accurate before the auditor arrives. 

Don’t Leave Your Certificate To Chance 

With stricter auto-fail criteria and a 14-day patching window now in force, the path to compliance has become more complex.  

Our Cyber Essentials Guided Pass service is designed to take the stress out of the process. From initial scoping to the final audit, our team ensures every box is ticked before submission, guaranteeing a quick and easy result. 

Back to our blog