Since 27 April 2026, new Cyber Essentials certifications are assessed against version 3.3 of the NCSC (National Cyber Security Centre) Requirements for IT Infrastructure and use the Danzell question set, which replaced Willow. The scheme is revised every year – we update this page each time a new version takes effect.
The biggest changes in the most recent update:
- Cloud services can’t be excluded from your scope
- MFA (multifactor authentication) is mandatory wherever a Cloud service offers it
- Missing the 14-day patching deadline is an automatic fail.
Cloud services can’t be excluded from scope
Version 3.3 defines Cloud services for the first time. The NCSC describes a Cloud service as an on-demand, scalable service hosted on shared infrastructure and accessed via the Internet. For Cyber Essentials, you access it with an account (credentials your organisation issues, or an email address used for business purposes), and it stores or processes your organisation’s data.
If your organisation’s data or services are hosted on Cloud services, those services must be in scope. The requirements put it plainly: “Cloud services cannot be excluded from scope.”
That covers platforms such as Microsoft 365 and Google Workspace, as well as CRM (customer relationship management) and other SaaS (software as a service) tools.
For many organisations, the systems they rely on most sit in the Cloud, so this closes a gap between how they work and what they put forward for assessment. It also puts access control at the centre of the assessment: Cloud risk comes down largely to how accounts are authenticated and managed.
Partial scope needs stronger justification
You can still certify part of your organisation rather than the whole of it. If you do, you must justify the partial scope to your assessor and show that anything you’ve excluded is separated from the rest of your network. That usually means a defined subset, segregated with a firewall or VLAN (virtual local area network).
The reasoning is sound. Many attacks move sideways from one weakly managed area into other systems, so the scheme now expects you to prove that boundaries exist and are maintained.
To answer the scoping questions cleanly, you need to know which networks exist, which devices sit on them, where your users work, how remote access is handled and which systems connect to the Internet.
MFA is mandatory for Cloud services
MFA used to be expected for Cloud services. It is now enforced. Where a Cloud service offers MFA and you haven’t enabled it, you fail the assessment automatically. IASME (The IASME Consortium), the NCSC’s delivery partner for Cyber Essentials, flagged the marking change, which applies to the Danzell questions on MFA and Cloud services (A7.14 to A7.17).
It makes no difference how MFA is provided: built in and free, bundled, delivered through another service or sold as a paid add-on, it must be switched on.
Because Cloud services can’t be left out of scope, weak identity controls are hard to hide behind a narrow scope statement. If your staff reach business data through SaaS platforms, you’ll need to show that MFA is enforced for administrators and users alike, with very limited exceptions.
For most organisations, the work lies in applying MFA consistently across every Cloud service, including the tools that sit outside central IT ownership.
The 14-day rule for security updates
If you don’t install high-risk and critical security updates within 14 days of release, you fail your assessment automatically. Danzell asks two new questions on the subject.
- A6.4 covers security updates and vulnerability fixes for operating systems and for router and firewall firmware.
- A6.5 covers security updates and vulnerability fixes for applications, including any associated files and extensions.
Both ask whether the updates were installed within 14 days of release.
Other changes in version 3.3
- Backups: These remain outside the five technical controls, but v3.3 explicitly recommends them and describes sensible precautions, such as keeping copies off the primary device and disconnecting removable media when it isn’t in use.
- User access control: The section puts more emphasis on MFA and passwordless authentication, such as FIDO2 authenticators, biometrics, security keys or tokens, one-time codes, QR codes and push notifications.
- Application development: The web application section now has this name and refers to the government’s Software Security Code of Practice.
Cyber Essentials Plus
The update also tightens the verification process for Cyber Essentials Plus. The FAQs below cover the detail, including what happens if an audit fails and how device sampling works.
What to do now
Certification lasts 12 months, so the practical question is when to absorb each year’s changes into your compliance cycle.
First-time certification
Treat v3.3 as a Cloud and identity project as much as a network hygiene one. Start by building an inventory of your Cloud services and identifying which of them store or process your organisation’s data. Then confirm how access to each is controlled, particularly administrator access, and enforce MFA consistently.
Renewal
Focus on what has changed, not on what you did last year. If you’ve adopted more Cloud services since then, your previous scope statement may no longer match what the scheme expects. Confirm your current devices, networks, remote working model and Cloud services, then check that you can answer the scoping questions cleanly and consistently.
You can preview the Danzell question set on the IASME website before you begin.