Key Takeaways
- Danzell keeps the five Cyber Essentials controls but marks some more strictly, with new auto-fail questions on MFA and patching.
- Cloud services holding your data are always in scope, and MFA must be on wherever it is available, including as a paid add-on.
- Automatic Windows updates rarely meet the 14-day rule on their own. Third-party applications, runtimes and extensions need checking too.
- Modern privileged access tools can work under Cyber Essentials, as long as the admin identity maps to the account separation requirement.
On this page
You patch automatically. MFA is switched on for Microsoft 365. Your last Cyber Essentials renewal went smoothly. So why does Danzell feel harder?
Since 27 April 2026, new Cyber Essentials assessments have used the Danzell question set, which delivers version 3.3 of the NCSC’s requirements. The five technical controls are the same as before. What has changed is how strictly some of them are marked, and how much of your environment counts as in scope.
Our assessors have been tracking the questions IT teams are raising most often since Danzell went live. A clear pattern stands out. Most organisations are not struggling because their security is weak. They are struggling because Cyber Essentials interprets their environment differently from the way they do.
What Changed With the Cyber Essentials Danzell Question Set?
Danzell replaced the previous Willow question set. Our Cyber Essentials April 2026 update covers the change in more detail, and our Cyber Essentials page explains the basics if you are new to the scheme. The changes that matter most are:
- Cloud services are fully in scope. If a cloud service holds your organisation’s data or services, it cannot be excluded.
- MFA is now an auto-fail. If a cloud service offers multi-factor authentication and it is not enabled, the assessment fails.
- The 14-day patching rule is now an auto-fail. High and critical security updates must be applied within 14 days of release, across operating systems, firmware and applications.
- Cyber Essentials Plus testing is tighter. A failed device sample now leads to retesting, and a second failure has wider consequences (more on this below).
None of these are new ideas. MFA and timely patching have been part of Cyber Essentials for years. The difference is that areas which were once treated as points to fix are now pass or fail.
Why Is Scoping the Biggest Danzell Challenge?
Why it catches people out. Many organisations start with a clear picture of their managed laptops and servers. Then a less obvious device or service turns out to change the scope. Common examples include staff checking Microsoft 365 email on personal phones, HR or payroll apps used from home devices, and tools a department signed up to without involving IT.
What Danzell requires. Any device or service that connects to the internet and accesses organisational data or services is expected to be in scope, unless an exclusion can be clearly justified. Cloud services holding your data cannot be excluded at all.
Where it gets tricky. Bring your own device (BYOD) is the most common edge case. For large mobile fleets in particular, bringing personal devices in line with the controls can take real configuration and ongoing management effort.
Teams that work differently. Development teams pulling in new packages every day, labs, legacy systems and very large or mixed estates can all make the controls harder to apply consistently. Moving development work onto segregated environments can help, but any exclusion needs to be clearly justified and agreed with your assessor.
What to do before you submit:
- Build a list of every cloud service your organisation uses, including ones signed up for by individual teams.
- Decide your BYOD approach early: manage the devices, restrict what they can access, or keep organisational data off them.
- Raise any scoping questions with your assessor at the start, not after you have completed the questionnaire.
Do All Cloud Services Need MFA Under Danzell?
If MFA is available, yes.
Why it catches people out. Most organisations have MFA on their main platforms, such as Microsoft 365 or Google Workspace. The gaps are usually in the long tail: supplier portals, marketing tools, finance apps and other accounts that have built up over time.
What Danzell requires. Where a cloud service offers MFA and it is not enabled, the assessment fails. That includes MFA offered as a paid option or through another service. IP allowlisting is no longer accepted as an alternative.
What to do before you submit:
- Use your cloud service list to check which services offer MFA, and switch it on.
- Where you can, connect services to single sign-on, so MFA on your main identity platform covers them.
- Review services nobody uses any more, and close them rather than securing them.
Why Automatic Patching Isn’t Always Enough For the 14-Day Rule?
Why it catches people out. A common assumption is that “we patch automatically” means compliant. But Windows Update and manufacturer tools mainly cover the operating system and drivers. A Cyber Essentials Plus scan can still find high or critical vulnerabilities in other software, such as older runtimes, browser extensions, plug-ins or leftovers from uninstalled programs. These usually need fixing individually.
What Danzell requires. High and critical security updates must be applied within 14 days of release. The two questions covering this are now auto-fail, and they apply to operating systems, firmware and applications.
What to do before you submit:
- Run an internal vulnerability scan well ahead of any CE Plus assessment, not just before it. Regular vulnerability scanning can make this part of routine work.
- Check third-party applications, runtimes and extensions, not only the operating system.
- Remove software you no longer need. Anything uninstalled cannot fail the 14-day rule.
How Do Separate Admin Accounts Work With PAM and Just-In-Time Access?
Why it catches people out. Many organisations have moved to privileged access management (PAM) or privileged identity management (PIM) tools. These give staff time-limited, logged admin rights only when they need them. Being told this needs changing can feel like a step backwards, and Linux teams raise the same point about sudo.
What Danzell requires. Cyber Essentials requires admin activity to be done from an account kept separate from the one used for everyday tasks like email and web browsing.
Where it gets tricky. IASME’s guidance draws a line between “just enough” privilege and simply raising a normal user account’s rights “just in time”. If the same everyday account is elevated, even briefly and with full logging, that approach on its own does not meet the account separation requirement.
The good news. PAM and PIM tools can work under Cyber Essentials. They can be set up in many different ways, and the key is that the identity used for admin work maps correctly to the separation requirement. In many cases, that is a configuration change rather than a new tool. It is a good example of how knowing security well is not quite the same as knowing how Cyber Essentials interprets it.
What to do before you submit:
- Map how admin rights are actually granted in your environment, for Windows, Linux and cloud platforms.
- Check whether elevation happens on a separate admin identity or on the user’s everyday account.
- Talk your model through with your assessor early, so any changes can be planned rather than rushed.
What Happens if a Cyber Essentials Plus Sample Fails?
CE Plus includes hands-on testing of a sample of your devices. Danzell changes what happens if that sample shows a problem with security updates. If you’re still deciding which level is right for you, our guide to Cyber Essentials vs Cyber Essentials Plus explains the difference.
What Danzell requires. If the sample fails on update management, you fix the issues, and then both the original sample and a new random sample are tested. If that second round also fails, the CE Plus assessment fails and your verified self-assessment Cyber Essentials certificate is revoked.
Why this matters. It checks that patching works across the whole estate, so finding problems yourself before testing starts is now more valuable than ever.
What to do before you submit:
- Treat any issue found on one device as a sign it may exist elsewhere, and check the wider estate.
- Run your own scan of a representative spread of devices before the assessor does.
- Make sure fixes are applied through your normal tools, so they reach every device, not only the sampled ones.
Danzell Rewards Early Preparation
Danzell has raised the bar in a few specific areas, but the scheme’s purpose has not changed. It is still a practical baseline that protects against the most common attacks. Most of the challenges organisations are facing come down to scope and interpretation. Advice online often conflicts, partly because some of it was written for the previous question set, so it pays to agree your approach with an assessor early.
Want to know where you stand before Cyber Essentials Plus?
GRACE (Guided Readiness Against Cyber Essentials) is a one-day session, booked after your first Cyber Essentials submission. In the morning, we review your self-assessment with you directly. In the afternoon, we run through all the Cyber Essentials Plus test areas on a sample of your devices, so issues with scope, MFA, patching or admin accounts come to light before your assessment. You receive a summary report afterwards.
Adam Gleeson
Adam is a Cyber Essentials and Cyber Essentials Plus Assessor who helps organisations achieve and maintain certification. Drawing on a broad background in cybersecurity, he provides practical guidance that helps customers navigate the assessment process with confidence.
