On 27 April 2026, the Cyber Essentials scheme updates to version 3.3. Any assessment account created on or after that date must follow the new requirements and use a new question set called Danzell, which replaces the outgoing Willow version.
IASME and the NCSC have positioned these as refinements rather than a major overhaul, but several specific changes have real teeth. If you have been coasting on last year's setup, the new rules around cloud services and authentication will catch you out.
What Is Actually Changing?
1. MFA Is Now an Automatic Fail Trigger
This is the most significant change for small businesses. Under Danzell, if a cloud service offers Multi-Factor Authentication (MFA) and you have not enabled it, your assessment will automatically fail. There is no grace period.
- IP allowlisting is no longer accepted as a substitute for MFA.
- This applies to all logins, including Microsoft 365, Google Workspace, CRM, and accounting software.
2. Formal Cloud Service Definitions
For the first time, v3.3 provides a strict definition for cloud services. If your data sits in a service hosted on shared infrastructure, it is in scope. You can no longer exclude tools just because they are managed by a third party.
3. Scoping Language Simplification
Terms like "untrusted" and "user-initiated" have been removed. The 2026 rules are simple: if a device can establish or accept an internet connection, it is in scope. Where you want to exclude a network segment, you need clear justification and evidence of proper segregation.
4. Passkeys and Passwordless Authentication
Version 3.3 explicitly recognises passkeys as the NCSC preferred default. While not mandatory today, adopting FIDO2 authenticators and biometrics now will future-proof your business against upcoming tightenings of the scheme.
Preparation Checklist
Why This Matters Beyond Compliance
Cyber Essentials is often mandatory for government contracts, but it also triggers free cyber liability insurance up to £25,000 for UK firms with a turnover under £20 million. Certification helps address the most common route into small business systems: credential theft.
Frequently Asked Questions
Prepare for Certification
Not sure where you stand? Use our free email security checker to verify your configuration, or book a consultation to review your scope before the April deadline.