Cyber Essentials: April 2026 Changes (v3.3 / Danzell)

What changed, and when

Requirements for IT Infrastructure v3.3 applies to all assessment accounts created on or after 27 April 2026, using the new Danzell question set (which replaces the previous ‘Willow’ set / v3.2). Accounts opened before that date finish under the old requirements. The five technical controls are unchanged — but how they're marked has tightened.

The changes that catch people out

• MFA is now decisive. Multi-factor authentication must be used wherever it's available, and it's mandatory on cloud services. Missing MFA on an in-scope cloud service is an automatic fail. The scheme is pushing toward passwordless and passkeys as the direction of travel.
• Patching within 14 days. Failing to apply high-risk or critical updates within 14 days — for operating systems, applications, and router/firewall firmware — is an automatic fail.
• All cloud services in scope. A clearer definition of ‘cloud service’ has been added, and all of them are in scope. Vague or convenient exclusions no longer wash.
• Tighter scope and network rules. Ambiguous ‘untrusted connection’ language is gone; devices that can reach the internet are in scope, and excluded segments need clear justification and evidence of segregation.
• Backup elevated. Recovery guidance now sits earlier in the document, reflecting how much ransomware impact comes down to whether you can restore.

Stricter Cyber Essentials Plus

The audited level tightened too: your self-assessment answers are locked before technical testing begins and can't be amended afterwards; if the device sample fails, the re-test now includes both the original and a fresh random sample; and a second failure can revoke the underlying certificate. In short, there's less room to fix things on the day.

What to do about it

Most organisations pass if they get three things right before submitting: MFA everywhere (especially cloud), critical patching inside the 14-day window, and honest, complete scope. We assess you against v3.3 as it's actually marked, tell you plainly what to fix, and get you through — first time. This page is refreshed each April as the scheme updates.

Common questions