Cyber Essentials, the government-backed scheme that shows customers and suppliers you have the basics of cyber security in place, is getting its annual update. From 27 April 2026, assessments move to version 3.3 of the requirements, delivered through a new question set called Danzell.
The five technical controls are unchanged: firewalls, secure configuration, user access control, malware protection and security update management. What changes is how strictly some of them are applied.
Who is affected, and when
Assessment accounts created on or after 27 April are assessed against the new requirements.
If you certify or renew before then, you are assessed under the current requirements (the Willow question set), and the new rules apply at your next renewal.
If your renewal is due in the next few weeks, starting before 27 April gives you a little more time. It does not let you avoid the changes, so it is worth getting ready now either way.
The changes that matter
Multi-factor authentication on every cloud service. If a cloud service offers MFA, it must be switched on, and for every user, not just administrators. Not having MFA enabled where it is available is an automatic fail. This catches the services people forget: the accounting package, the HR system, the supplier portal, the domain registrar.
Critical updates within 14 days, everywhere. The 14-day rule for high-risk and critical security updates now explicitly covers routers, firewalls and applications, not just operating systems. Missing it is an automatic fail.
The cloud cannot be left out. There is now a formal definition of cloud services, and they cannot be excluded from scope. If your business uses it, it is in.
Clearer scope. You must list every legal entity covered by the certificate and describe any parts of your IT that are excluded. Group companies can now hold a certificate per legal entity.
Cyber Essentials Plus is stricter. You can no longer change your self-assessment answers based on what the Plus assessor finds, and a second failure revokes the self-assessment certificate.
How to get ready
List every cloud service you use, including the small ones, and check MFA is on for every account in each. Microsoft 365 is usually the easy part; the forgotten logins are where people fail.
Check how you patch the things that are not PCs. Routers, firewalls, line-of-business applications and browser plug-ins all need a way to get critical updates on within 14 days.
Agree your scope early, so there are no surprises about which companies, sites and systems are covered.
We can help
We take businesses through Cyber Essentials and Cyber Essentials Plus, from the first gap check to the certificate. If your renewal is coming up, or you want to certify for the first time under the new rules, see our Cyber Essentials certification service, talk to us or call 01642 661888.