Cyber threats are evolving, and the standards designed to protect your business are evolving with them. On 27 April 2026, updates to the Cyber Essentials scheme came into effect, introducing a number of important changes to both Cyber Essentials (CE) and Cyber Essentials Plus (CE+).
The new Danzell question set replaced the previous Willow question set and introduced updated requirements across both CE and CE+ assessments.
These updates reflect how organisations now operate, particularly in cloud-based and hybrid environments, and aim to ensure certification continues to represent genuine, real-world security.
If your business relies on Cyber Essentials for contracts, insurance or supply chain credibility, these changes are important. Not because they make certification harder, but because they make it more meaningful, consistent and aligned with modern security risks.
Why this update matters
Cyber Essentials has always focused on the fundamentals of good cyber hygiene. However, as businesses increasingly adopt cloud platforms and distributed IT environments, those fundamentals must now be applied more consistently and robustly.
The update strengthens trust in the scheme by ensuring organisations are not just compliant on paper, but properly protected in practice.
What changed in April 2026?
The core five controls remain unchanged, but their application and enforcement are clearer and more rigorous under the Danzell question set.
Multi-factor authentication (MFA) is mandatory where supported
One of the most significant changes for Cyber Essentials is mandatory multi-factor authentication (MFA) wherever it is supported by the cloud service in use.
This applies regardless of cost, meaning organisations may need to upgrade to higher-tier subscriptions to comply. If MFA is not fully implemented where it applies, the result is an automatic fail.
MFA has long been one of the most effective security controls, and its wider enforcement reflects its importance in preventing unauthorised access.
A stronger focus on cloud security responsibility
The guidance places clearer responsibility on organisations using cloud services such as Microsoft 365. While cloud providers secure the infrastructure, organisations remain responsible for how services are configured and used. This includes:
- User access and permissions
- Secure configuration of services
- Protection and control of data
Clearer expectations here help reduce common configuration mistakes that leave systems unnecessarily exposed, such as overly permissive access, weak administrative controls or insecure default settings.
Backups are not part of the Cyber Essentials requirements, but organisations are strongly encouraged to follow good practice: back up important data regularly and carry out test restores to confirm it can be recovered when needed.
A stronger focus on asset management and visibility
A key part of the guidance is better visibility of devices and assets across the organisation. You need an accurate understanding of what devices you have, who is using them and where they are being used. Without this, it is much harder to apply consistent security controls or show compliance.
You cannot effectively protect what you do not know you have.
This means greater emphasis on:
- Maintaining up-to-date asset registers
- Tracking devices assigned to users
- Making sure unmanaged or unknown devices are not present in the environment
- Applying consistent security policies across all endpoints
Cyber Essentials Plus vulnerability management changes
Cyber Essentials Plus has also been strengthened, particularly around vulnerability management.
Where vulnerabilities are found in the initial sample set, organisations still have 30 days to fix them. This is now followed by a second round of testing using a new sample set of the same size, to make sure fixes have been applied consistently across the wider environment and not only on the devices originally tested.
- If the same vulnerabilities are found again in the second sample set, the result is a fail.
- Any new or different vulnerabilities found at this stage are recorded as advisory findings and do not affect the result.
- If an organisation chooses not to provide a second sample set, it fails CE+ but keeps its Cyber Essentials certification.
Impact on certification status
Failing Cyber Essentials Plus now has a direct impact on Cyber Essentials certification. If an organisation fails CE+, its CE certification is revoked and it needs to complete the certification process again.
The one exception: if an organisation declines to provide a second sample set, CE+ is failed but the CE certification remains valid.
Applications started before 27 April 2026
Applications created before 27 April 2026 followed the transition rules and used the Willow question set. These organisations were not subject to the new Danzell requirements and had a six-month window to complete their certification before their application was archived.
How to prepare
To support organisations through these changes, we offer:
- Pre-assessment vulnerability scanning, as a one-off engagement before your Cyber Essentials Plus assessment or as an ongoing monthly service
- Optional patching support to help maintain compliance and reduce risk
Preparing early helps identify gaps in advance, avoid delays and ensure smoother certification outcomes.
What this means for your business
For most organisations, these changes do not require a complete overhaul. They do demand greater attention to detail, particularly around MFA, access control, asset visibility and cloud configuration.
If Cyber Essentials is linked to contracts or compliance requirements, failing or delaying certification could have a direct business impact.
Why acting early matters
Many organisations wait until renewal before addressing certification requirements. Under the Danzell question set, early preparation is more important than ever. Acting early lets you:
- Identify and fix gaps in advance
- Avoid last-minute delays
- Maintain compliance with contracts and insurers
- Strengthen your overall security posture
A stronger standard for modern security
Cyber Essentials remains focused on the fundamentals:
- Securing devices
- Controlling access
- Keeping systems updated
- Protecting against common threats
What has changed is the expectation that these controls are applied consistently across the entire organisation.
Cyber Essentials is no longer just a certification. It is a signal to customers, partners and insurers that your organisation takes security seriously.
Take action now
If your Cyber Essentials certification is due for renewal, or you are planning to become certified, now is the time to prepare. Understanding the changes will help you avoid disruption, stay compliant and keep your organisation protected under the updated scheme.
Get Cyber Essentials certified, prepare for Cyber Essentials Plus or get in touch to talk it through.