The new Danzell question set represents a significant step forward for Cyber Essentials and Cyber Essentials Plus. The questions are designed to strengthen real-world security, reduce ambiguity in assessments, and ensure organisations are meeting the standard in practice - not just on paper.
Changes coming with Danzell
The Danzell question set introduces several important updates. Here’s what you need to know.
Multi-factor Authentication (MFA) is now mandatory across all cloud services
Any cloud service where MFA is available must have it enabled, even if it’s a paid service at an additional cost. This includes SaaS platforms, business tools, and systems using single sign-on (SSO).
Failure to implement MFA where available will result in an automatic fail.
Cyber Essentials scoping requirements are stricter
Organisations must clearly define and justify their scope.
Scope must be based on network boundaries - not departments or user roles.
All internet-connected devices must be included unless there is a clear and valid justification for exclusion.
Evidence requirements are more robust
Organisations must now provide clearer, verifiable evidence that security controls are in place and actively enforced.
This means:
Being able to demonstrate that settings (such as MFA) are enabled across relevant systems
Providing evidence that policies are applied consistently across users and devices
Ensuring configurations can be validated, rather than assumed
Auditors will increasingly look for proof that controls are working across the organisation - not just that they have been defined.
Changes to Cyber Essentials Plus audits
The audit process for Cyber Essentials Plus is also becoming more rigorous.
This includes:
A random sample of devices being tested during the audit
If vulnerabilities are found, they must be remediated within 30 days, before further testing
A second random sample will then be tested
If vulnerabilities identified in the initial sample are found again in the second sample, the audit will fail and may result in certification being revoked
This replaces the previous approach where passing a single sample could still result in certification.
Cyber Essentials is now a “point-in-time” certification
Certification reflects your organisation’s security posture at the point the certificate is issued.
This means:
Organisations must be fully compliant at the point certification is granted
Auditors are expected to confirm that all requirements have been met before issuing the certificate
There is limited ability to defer certification while issues are resolved
In practice, this places greater emphasis on ensuring controls are consistently in place ahead of certification.
What this means for you
These changes increase the importance of preparation and visibility ahead of certification.
In practice, this means:
MFA must be consistently enabled across all cloud services
Vulnerabilities need to be identified and resolved earlier
Scope definitions must be clear and complete
Organisations should ensure they are ready before booking a Cyber Essentials Plus audit
Final Thoughts
The impact of these changes should ultimately be positive. While the requirements are stricter, they improve the consistency, credibility, and real-world effectiveness of Cyber Essentials certification.
We appreciate that these updates may feel like a big shift. They’ve been introduced by IASME to strengthen the standard and ensure all organisations are meeting the same level of security. While these changes are outside of our control, we’re here to help make the process as smooth as possible.
It’s well worth familiarising yourself with the new requirements ahead of your next renewal.
If you need any further guidance on these changes and how they will impact you, speak to our Support team. You can contact them at support@cybersmart.co.uk or via our live chat.