What changed in April 2026: the Danzell question set
If you last certified before 27 April 2026, this year's renewal is stricter. The five controls are the same, but more answers now mean an automatic fail.
What changed
- New rules and questions. Since 27 April 2026, new assessments use the NCSC's Requirements for IT Infrastructure v3.3 and IASME's Danzell question set, which replaced the Willow set.
- Same five controls. Firewalls, secure configuration, security update management, user access control and malware protection.
- Stricter marking. More questions are now automatic fails, especially on multi-factor authentication (MFA) and keeping software updated.
- Cloud is always in scope. You can't leave out cloud services such as Microsoft 365 or Google Workspace.
Check these before you start
- MFA everywhere it's offered on cloud services, especially email and admin accounts.
- Critical and high-risk updates within 14 days on every device and app in scope. Turn on automatic updates where you can.
- No unsupported software or devices. Anything that no longer gets security updates must be replaced, or isolated from the internet.
- Separate admin accounts that aren't used for everyday email and browsing.
- Malware protection switched on and up to date on every device.
Renewing? Don't copy last year's answers. The questions and the pass marks have changed.
Sources: NCSC Cyber Essentials; IASME. Always check the current requirements with your certification body before you start.
Ready to get certified?
Tell us about your business and we'll introduce you to accredited certification bodies — free, no obligation.
Get matched