Cyber Essentials 2026 Changes Explained: The Danzell Rules Now in Force

Updated 28 September 2026 · By Yann Davies, Managing Director, ABCOM IT Solutions (NCSC Assured Service Provider – Cyber Advisor)

The biggest change to Cyber Essentials in years is now in force. Since 27 April 2026, assessments use the “Danzell” question set (requirements v3.3). The five technical controls haven’t changed, but they’re now marked far more strictly. Here’s what changed, what it means for Microsoft 365 users, and how to pass first time.

What changed in April 2026

Before (Willow, v3.2)

• Some gaps could be fixed during assessment
• MFA expected on cloud services, with some leeway
• Occasional late patches not always fatal

Now (Danzell, v3.3, from 27 April 2026)

• Missing MFA on a cloud service = fail
• Critical patch older than 14 days = fail
• Cloud services with your data are always in scope

The transition period has ended for most organisations. Assessment accounts opened before the change had a six-month window to finish under the old rules, so any renewal from late October 2026 is assessed against Danzell.

What it means for Microsoft 365 businesses

Most small businesses run on Microsoft 365, so this is where most failures happen. Check these before you apply:

1. MFA for every user, including admins, shared mailboxes that allow sign-in, and any old accounts. Use Security Defaults or Conditional Access.
2. MFA on every other cloud service: your CRM, accounts software, file sharing, website admin and domain registrar. If it offers MFA, switch it on.
3. Automatic updates for Windows, Microsoft 365 apps, browsers and PDF readers, plus firmware for routers and firewalls, with evidence that critical updates land within 14 days.
4. Remove unsupported devices and software. Windows 10 reached end of support in October 2025, so any Windows 10 devices in scope need to be upgraded, replaced or covered by Extended Security Updates.
5. Admin accounts kept separate from everyday accounts, with no admin rights for general users.
6. Defender or equivalent anti-malware active on every in-scope device.

Cyber Essentials Plus

Cyber Essentials Plus adds a hands-on technical audit of a sample of your devices and accounts. It uses the same stricter rules, so testers will check that MFA is really enforced and that critical patches are within 14 days. If you’re aiming for Plus, fix the basics first, as a failed audit means retesting.

Why Cyber Essentials is still worth it

• It reduces risk: claims data from the scheme’s insurer showed certified organisations were 92% less likely to make a cyber insurance claim.
• Free insurance: UK organisations with turnover under £20m that certify their whole organisation can opt in to cyber liability insurance with up to £25,000 of cover.
• It wins work: Cyber Essentials is required for many public sector contracts and more and more private supply chains.

How to pass first time

1. Scope it properly: list every device, user and cloud service that touches your data.
2. Run a gap check against the Danzell requirements, with MFA and patching first.
3. Fix and gather evidence: screenshots of MFA and update policies, and a device list.
4. Complete the online assessment, or book your Cyber Essentials Plus audit.
5. Keep it going: certification lasts 12 months, so keep patching within 14 days all year, not just at renewal.

How ABCOM helps

As an NCSC Assured Service Provider, we guide Sussex and UK organisations through Cyber Essentials and Cyber Essentials Plus from start to finish. We run the gap check, fix the Microsoft 365 settings, prepare your evidence and support you through assessment. See our Cyber Essentials service or read the full Small Business Guide to Cyber Security.

Frequently asked questions

Sources

• IASME: Cyber Essentials
• NCSC: Cyber Essentials overview
• NCSC Annual Review 2025: Cyber Essentials impact
• IASME: Cyber liability insurance
• UK Government: Cyber Security Breaches Survey 2025/2026