Cyber Essentials 2026: what actually changed, and the sessions that explain it

Every year Cyber Essentials gets a new question set with a name that sounds like a village, and every year someone asks whether this is the year it gets hard. For 2026 the answer is a qualified yes. The five controls are the same ones you've been certifying against since the scheme started. What changed in April is that two of them stopped being things you could be a bit behind on.

I've been through this renewal cycle more than once as the IT person at a law firm, and the questions below are the ones that come up every renewal, in law firms and everywhere else I've compared notes.

Short version

• New question set (Danzell, v3.3) for any assessment opened from 27 April 2026. The five controls haven't changed; the marking has.
• MFA missing on any cloud service that offers it is now an automatic fail. Free tier or paid, doesn't matter.
• High and critical patches not applied within 14 days of release is now an automatic fail, for OS, firmware and applications.
• Cloud services can't be left out of scope any more, and you have to list every legal entity covered.
• Plus got stricter: fail the first sample and the assessor tests a second one, and you can't change your self-assessment once Plus testing starts.

Is it actually a new scheme, or the same thing with a new name?

Same scheme, tighter marking. The question set moved from Willow (v3.2) to Danzell (v3.3) for any assessment account created from 27 April 2026. If you'd already opened an account under Willow before that date you got six months to finish on the old set, which runs out at the end of October 2026. After that everyone's on Danzell.

The underlying controls (firewalls, secure configuration, access control, malware protection, security updates) didn't change. The thing to understand is the word "auto-fail". Under Willow, a weak answer on most questions was a non-compliance you could argue about or fix on resubmission. Under Danzell, three areas end the assessment on the spot regardless of how well you did everywhere else.

MFA is on. Why would we fail on MFA?

Because "on" usually means on for Microsoft 365, and the auto-fail applies to every cloud service in scope where MFA is available at all, whether it's free, included or a paid add-on. If the service offers it and you haven't turned it on for everyone, that's the assessment over.

The services that catch people are rarely the big ones. It's the practice management system that only supports MFA on the admin login. The e-signature platform someone signed up to years ago. The HR portal, the dictation app, the payroll bureau's web upload. When I did this at a law firm we counted eight cloud services the fee-earners were using and found half of them without MFA enforced. The first job is a list of everything with business data in it, not a policy.

We patch monthly. Is that a problem?

It can be. High-risk and critical updates have to be installed within 14 days of release, and that rule is now two auto-fail questions: A6.4 covers operating systems plus router and firewall firmware, A6.5 covers applications and their extensions. Note the word "release", not "when our RMM noticed".

Monthly Patch Tuesday cycles are usually fine for Windows. Where it falls apart is third-party apps (browsers, PDF readers, the odd legal-specific tool that updates on its own schedule), firewall firmware nobody's logged into since install, and the laptop that's been in a drawer for three weeks. If you're going for Plus, be aware the assessor now tests a second random sample if the first one fails. Patching only the machines they looked at last time is exactly what that change exists to stop.

What counts as a cloud service, and can we leave some out?

For the first time the requirements define it: an on-demand service, on shared infrastructure, reached over the internet via an account, that stores or processes your data. If it meets that, it's in scope and it cannot be excluded. Leaving the case management system out because it's "the supplier's responsibility" is no longer an option.

Scoping also got more formal. You can write a proper scope description now (not just a line on the certificate), but you also have to describe what's out of scope, why, and how it's segregated. And you have to list every legal entity covered, with company number. If you run an LLP alongside a service company, both need naming.

What does the director have to sign?

The board-level declaration now includes a line acknowledging responsibility for keeping all the controls in place for the whole certification period, not just on submission day. The scheme also pinned down "point in time" as the date the certificate is issued, which matters if a Windows version or firewall goes out of support between you submitting and the cert landing.

For a managing partner that's a different conversation from the one you had last year. It's worth having it before you submit rather than after.

Should we just pay someone to do it for us?

Plenty of firms do, and I'm not going to tell you it's wrong. But I've never outsourced Cyber Essentials, and I'd push back on the idea that you have to.

Here's how it's actually worked for me. The self-assessment is a set of questions about your own environment, and most of the answers are things you either know or can find out in ten minutes. Where I haven't known (how the firewall is configured, what the patching schedule on the servers really is, whether a particular box in a branch office is still on the network) I've asked our MSP. That's not a project. Answering questions about the estate they manage is what the support contract is for, and I've never had an MSP push back on it.

Where it does become a project is when the answers come back wrong. If MFA isn't enforced on something, if the firewall firmware is two years behind, if there's a Windows 10 machine nobody's touched, fixing those is real work and you should expect to pay for it, either in hours or as a quoted piece. That's not "doing Cyber Essentials for you", though. That's remediation you needed anyway, and the assessment just told you about it.

The case for paying a certification body or consultancy to run the whole thing is time. If you're a one-person IT function with no slack, or you've got no IT function at all and the office manager's been handed it, a few hundred pounds for someone to walk you through it is money well spent, and a readiness review before Plus can save you a failed audit. Just be clear what you're buying. Nobody can answer the questions better than someone who knows the environment, and nobody else is signing the declaration.

The thing I'd avoid is the version where your MSP both runs your estate and answers the questions about it with no one on your side reading them. Danzell has made the answers binding in a way they weren't before, so somebody who works for you needs to read them.

Do we need Plus?

Nobody can tell you that except your clients and your insurer. Plus is increasingly a tender condition for public sector, healthcare and legal panel work, and some cyber insurers price on it. If you're going for it, two procedural changes bite: your self-assessment is locked once Plus testing starts (no going back to change answers after the audit finds something), and a second failed sample set after remediation revokes the self-assessment certificate you already had.

In other words, don't book Plus to find out whether you're ready. Find out first.

If you only do three things before renewal

Build the list of every cloud service with business data in it and check MFA on each. Pull a report of anything in the estate older than 14 days on a high or critical patch, and chase the stragglers. Then read the Danzell question set end to end before you open the assessment account, because that's the point the clock starts. And if you're using your MSP for the answers, make sure someone who works for you reads them before they go in.