Cyber Essentials v3.3 (Danzell): what changed in April 2026

Cyber Essentials Danzell is the question set that went live in late April 2026, alongside version 3.3 of the Requirements for IT Infrastructure. The five technical controls stayed the same, and the biggest changes were to how some questions are marked.

The NCSC and IASME review the requirements every year. IASME set out this year's changes in February 2026, and they apply to every assessment account created since the update went live.

What became an automatic fail under Danzell

Multi-factor authentication (MFA) was already required for cloud services. Now, not turning it on where a cloud service offers it fails the assessment, even when MFA is a paid extra.

The same goes for questions A6.4 and A6.5, which ask whether high-risk and critical security updates are installed within 14 days of release. The 14-day window was already in the requirements, and since Danzell a no to either question fails the whole assessment.

Cloud services got a formal definition

Version 3.3 defines a cloud service as an on-demand, scalable service hosted on shared infrastructure and reached over the internet. For Cyber Essentials, it's accessed through an account and stores or processes data for your organisation.

If your data or services sit in cloud services, those services are in scope. The requirements now state that cloud services can't be excluded.

Scoping rules got simpler

The words 'untrusted' and 'user-initiated' no longer qualify which internet connections count. A device is in scope if it can connect to the internet in either direction, or if it controls the flow of data between other devices and the internet.

If you leave part of your network out, you now have to justify it. You also have to explain how the excluded part is kept apart from the systems in scope.

Other changes in v3.3

The 'web applications' section became 'application development' and now points to the UK Government's Software Security Code of Practice. Publicly available commercial web applications are in scope by default, while bespoke and custom components are out of scope.

Guidance on backups moved earlier in the document, to stress how much recovery after an incident depends on them. The user access control section gives more weight to passwordless sign-in methods such as passkeys, and FIDO2 authenticators count as MFA.

Certificates and declarations

Certificates can now carry a full scope description, and you have to list every legal entity in scope. You also have to describe the parts of your infrastructure you've left out, though that part isn't published.

The 'point in time' for an assessment is now the date the certificate is issued, so your systems have to be supported on that date. The director's declaration also commits you to keeping the controls in place for the whole certification period.

If your renewal is due

A new assessment account uses v3.3 and the Danzell questions. Once you've created it, you've got six months to complete the assessment.

If you've still got Windows 10 devices, check how they're covered before you submit. Our guide on how to prepare for the assessment walks through each control.

As an IASME-accredited Certification Body, we certify Cyber Essentials directly under the current requirements.

Sources

• IASME, Important update: changes to Cyber Essentials for April 2026, 12 February 2026 (opens in a new tab)
• IASME, Upcoming changes to the Cyber Essentials scheme: April 2026 update, 3 November 2025 (opens in a new tab)
• NCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 (opens in a new tab)