Cyber Essentials 2026 Changes: What v3.3 and Danzell Mean for You
Cyber Essentials was updated in April 2026. Every assessment account created from 27 April 2026 is assessed against the NCSC Requirements for IT Infrastructure v3.3, using IASME's new question set, called Danzell. It replaces the previous set, Willow (v3.2).
The five controls haven't changed. What changed is how strictly scope is applied, especially for cloud services.
The changes at a glance
| Change | What it means for you |
|---|---|
| Cloud services can't be excluded | If your data or services are hosted in the cloud (Microsoft 365, Google Workspace, Xero, Dropbox, your CRM), they're in scope. No exceptions. |
| A definition of "cloud service" | Any on-demand, internet-accessible service you sign into with a business account that stores or processes your data. Free tools signed up with a work email count. |
| Partial scopes must be justified | If you leave part of the business out, you must explain why to the assessor. The whole business is the safest scope. |
| FIDO2 counts as passwordless | Passkeys and FIDO2 security keys are recognised as passwordless authentication and as MFA. |
| "Untrusted connections" wording removed | Scope is now based on whether a device can connect to or accept connections from the internet. |
| Backups emphasised | Still not a pass/fail requirement, but strongly recommended. |
| Software Security Code of Practice | Referenced for businesses that develop their own software. |
The change that catches people out: cloud services
Most small businesses use more cloud services than they realise. The rule is simple: every cloud service you use for business must have MFA switched on for every user.
Before you apply, list every service your team signs into. Check card statements for subscriptions, and ask staff about free tools they've signed up for with a work email. Each one needs MFA.
Who does what in the cloud?
You're always responsible for making sure the controls are met, but the provider handles some of them. For software-as-a-service like Microsoft 365, the provider handles firewalls, patching and malware protection. You are responsible for user access control (accounts, MFA, admin rights) and secure configuration.
What hasn't changed
- The five controls: firewalls, secure configuration, security updates, user access control and malware protection
- High and critical updates within 14 days
- Password rules: MFA, or 12+ characters, or 8+ characters with common passwords blocked
- Renewal every 12 months
What to do now
- List every cloud service you use, including free ones.
- Turn on MFA for every user on every one.
- Work through the full Cyber Essentials checklist.
- Only apply once every item is in place today.
Updated for v3.3 and Danzell
The Readiness Pack covers the new cloud scope rules, with a scoping guide, 5-control checklist, inventory sheets and an MFA policy template.
Get the Readiness Pack from £24Source: NCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026). Always check the latest version before you apply.