The Shift from Willow to Danzell

The five technical controls behind Cyber Essentials have not changed. The way they are marked has. That distinction is the reason organisations who certified comfortably in 2025 are now failing on questions they have answered the same way for three years running.

IASME published the Danzell question set on 13 February 2026, replacing Willow for all accounts created on or after 27 April 2026 (aligned to version 3.3 of the Requirements for IT Infrastructure). The six-month grace window for accounts opened under Willow closes this autumn.

What Actually Changed: Marking Tolerance, Not Controls

NCSC and IASME built Danzell around real breach investigations where organisations held valid certificates despite running weak MFA, inconsistent patching, and unscoped cloud platforms. Three changes carry most of the failure risk:

1. Multi-Factor Authentication Is Now Binary

If a cloud service you use offers MFA and it is not enabled for every user, that is an automatic failure of the entire self-assessment. Not a partial score. A failure.

Most organisations know MFA is enabled on Microsoft 365 or Google Workspace. Far fewer hold an exhaustive inventory confirming universal MFA across all third-party SaaS platforms, service accounts, and contractor logins.

2. Patching Windows Now Auto-Fail

Questions A6.4 and A6.5 sit in the automatic-failure category. They enforce the 14-day requirement for high-risk and critical security updates across all routers, endpoints, and applications.

Point-in-time evidence gathered the week of the assessment no longer suffices. Assessors require demonstrable evidence of an active, recurring 14-day patch cycle across the entire estate.

3. The Board Declaration Covers the Whole 12-Month Period

The director-level declaration now explicitly acknowledges responsibility for maintaining compliance throughout the certification period — not only on the day of assessment. If evidence only exists for one week in twelve months, the declaration is unsupportable.

Why This Breaks the Screenshot Model

A screenshot proves a configuration existed for one second. It cannot prove continuous 14-day patch adherence or 12-month universal MFA enforcement. This is why forward-looking organisations use repeated read-only scans with PyraLink™ Prove to record compliance state month on month.

What to Do Between Now and Your Renewal

  1. Audit Cloud MFA Universality: Review every SaaS tenancy against IASME's reference list to ensure complete MFA coverage.
  2. Verify 14-Day Patch Visibility: Confirm you have automated telemetry tracking patch age across all remote laptops, servers, and perimeter routers.
  3. Review Scope Boundaries: Scope reduction is legitimate; scope evasion is now rigorously flagged by assessors.

Further reading: How to Get Cyber Essentials Certified: A Step-by-Step Guide for North East Organisations and ISO 27001 Certification in the UK: A Practical Readiness Roadmap from Gap Analysis to Stage 2.

Hosting on Google Cloud? See our Cyber Essentials on Google Cloud checklist, which maps the five technical controls to the GCP settings that evidence them.

Supporting Cyber Essentials Plus Readiness

PyraLink™ Prove collects read-only configuration evidence from your cloud and Microsoft 365 accounts, such as MFA enforcement, that you can check against the Danzell requirements before your official assessment.

Request a PyraLink Prove Demo ↗

Sources: IASME scheme update and Danzell question set publication, February 2026; Cyber Essentials Requirements for IT Infrastructure v3.3; NCSC and DSIT-approved scheme changes effective 27 April 2026.