When did Danzell go live?

27 April 2026. From that date all new Cyber Essentials assessment accounts are created against the Danzell question set, aligned with NCSC Requirements v3.3.

Do the five controls change under Danzell?

No. The five core controls remain the same. Danzell tightens scoping, cloud, MFA and CE Plus audit methodology rather than adding new controls.

Can I still submit on Willow?

Only if your account was created before 27 April 2026 and you submit within the original six-month window. After that, you move to Danzell.

Does Danzell change the free £25,000 cyber insurance?

No. The free IASME cyber insurance for eligible UK organisations under £20m turnover continues unchanged with Danzell certificates.

Will Danzell make CE harder to pass?

Not if you are already meeting the controls properly. Firms that previously relied on loose scoping or borderline MFA evidence will need to tighten up.

Cyber Essentials Danzell vs Willow: Every Change Explained

What actually changed

Scoping – clearer rules on what counts as a sub-set scope and how home workers are declared.
Cloud services – sharper distinction between IaaS, PaaS and SaaS responsibility splits.
Multi-factor authentication – stricter wording on administrative accounts and cloud admin consoles.
Patching – the 14-day rule is unchanged, but evidence expectations are firmer.
CE Plus methodology – revised sampling and marking framework for the assessor.

What has not changed

The five controls – firewalls, secure configuration, user access control, malware protection and security update management – are identical. The 30-day rule between CE and CE Plus is unchanged. The free £25,000 cyber insurancefor eligible UK organisations is unchanged.

Which question set applies to you

If your assessment account was created on or after 27 April 2026, you are on Danzell. Accounts created before that date can still complete under Willow within the existing 6-month submission window, then move to Danzell at renewal. See our Danzell hub for the full transition timeline.

Where firms trip up

Assuming "no change" because the controls list looks identical.
Re-using Willow-era screenshots that do not address the new scoping wording.
Missing MFA on a cloud admin console that was previously borderline.

Next steps

Read our deep-dives on scoping, MFA and cloud services under Danzell, or book a Cyber Essentials assessment with our IASME-licensed assessors.