On this page · 12 sections
- What changed with Danzell, and the dates that matter now
- The two auto-fail rules in detail
- Scope changes that catch SMEs and MSPs out
- Cyber Essentials Plus under Danzell: retests and the Willow cutoff
- Fees, funding and insurance for 2027
- Worked example: a 35-person firm with an outsourced MSP
- Decision table: which route fits
- Remediation checklist for SMEs
- Remediation checklist for MSPs
- What to watch before April 2027
- How eCorpIT can help
- References
Summary. Every Cyber Essentials assessment account opened since 27 April 2026 is marked against the NCSC's Requirements for IT Infrastructure v3.3 and IASME's Danzell question set, and three answers now fail you outright whatever else you score. Any cloud service that offers multi-factor authentication (MFA) must use it, whether MFA is free, bundled or a paid add-on. Questions A6.4 and A6.5 require high-risk or critical updates for operating systems, router and firewall firmware, and applications within 14 days of release, where v3.3 counts a vendor rating of critical or high, a CVSS v3 base score of 7 or more, or no published severity. Cloud services can no longer be excluded from scope, every legal entity must be listed, and the point in time is the day the certificate is issued. The Willow transition is nearly over: one certification body dates the last Willow self-assessment to 26 October 2026 and the last Willow-based Cyber Essentials Plus audit to 26 January 2027. Fees run from £320 to £600 plus VAT by headcount, and the First Step Fund takes 75% off a first certificate bought by 31 March 2027. Switch MFA on everywhere and prove a 14-day patch cycle before you buy.
About this article. This guide is for owners, IT leads and managed service providers (MSPs) preparing UK organisations for Cyber Essentials or Cyber Essentials Plus in late 2026 and 2027. On 12 November 2026 we checked requirements, question numbers, dates, fees and funding against the NCSC's requirements document and scheme pages, IASME's scheme pages and articles, GOV.UK policy papers and Microsoft's lifecycle documentation. The Willow Plus cutoff comes from a certification body, because neither IASME nor the NCSC prints a calendar date. This is general information, not certification or legal advice: your certification body decides scope and marking, and no certification body paid for inclusion. Researched with AI assistance and reviewed by our editorial team.
What changed with Danzell, and the dates that matter now
IASME, the NCSC's delivery partner for the scheme, reviews it every year and says the April 2026 cycle kept the five technical controls (firewalls, secure configuration, security update management, user access control and malware protection) and changed how assessments are marked, scoped and audited. The NCSC lists v3.3 as effective from 27 April 2026. IASME applied the changes to assessment accounts created after 26 April 2026, gave older accounts six months to certify on the previous question set (Willow), and scheduled the Danzell question set for publication on 13 February 2026. Its preview page tells anyone buying from 27 April 2026 to prepare with Danzell.
The MFA auto-fail was first published in November 2025. IASME's February 2026 update added the two patching auto-fails, the scope changes and the Plus retest rule. The table draws on those pages, a certification body's transition notice, IASME's funding article and Microsoft's lifecycle page.
| Date | What happens | Status |
|---|---|---|
| 13 February 2026 | Danzell question set scheduled for publication | Confirmed (IASME) |
| 27 April 2026 | v3.3 and Danzell apply to new assessment accounts | Confirmed (NCSC, IASME) |
| 26 October 2026 | Last date to finalise a Willow self-assessment | Reported by a certification body |
| 3 November 2026 | Government announces the Cyber Essentials funding package | Confirmed (GOV.UK) |
| 12 January 2027 | Windows Server 2016 extended support ends; paid updates only after this | Confirmed (Microsoft) |
| 26 January 2027 | Last date for a Willow-based Cyber Essentials Plus audit | Reported by a certification body |
| 15 March 2027 | Pledge grant, first allocation: assessments must be submitted | Confirmed (IASME) |
| 31 March 2027 | First Step Fund: last date to buy the discounted assessment | Confirmed (IASME, GOV.UK) |
| April 2027 | Next annual scheme update expected; nothing published yet | Watch |
The October date has passed, so every new basic submission is a Danzell submission. The only Willow work left is a Plus audit for an organisation whose Willow certificate was issued in the last three months.
The two auto-fail rules in detail
MFA on every cloud service that offers it
v3.3 tells you to implement MFA where available and says authentication to cloud services must always use it. IASME's marking closes the cost loophole: failing to use MFA on a cloud service fails the assessment whether the MFA option is free, included in the plan or sold as an extra.
So if a line-of-business SaaS tool only offers MFA on a higher plan, you pay for the upgrade, replace the tool, or fail. You cannot fence the tool off either: v3.3 says cloud services that host your data or services must be in scope.
v3.3 now defines a cloud service for the scheme: an on-demand, scalable service on shared infrastructure, reached over the internet through an account (credentials your organisation issues, or a business email address), that stores or processes your data. Accounting platforms, CRMs, payroll portals, file-sharing tools and supplier portals all fit.
It lists four kinds of additional factor (a managed device, an app on a trusted device, a separate token, or a known or trusted account), treats FIDO2 authenticators as passkeys and as MFA, and accepts SMS while recommending stronger options. The password element of MFA must be at least 8 characters with no maximum length.
A6.4 and A6.5: the 14-day rule
The two new auto-fail questions cover the same clock for different software:
- A6.4 asks whether every high-risk or critical security update and vulnerability fix for operating systems and for router and firewall firmware is installed within 14 days of release.
- A6.5 asks the same for applications, including their associated files and extensions.
A no to either fails the assessment, regardless of the other answers. The v3.3 requirement behind them starts the 14-day clock in three cases: the vendor rates the fix critical or high risk; the vulnerability has a CVSS v3 base score of 7 or more; or the vendor gives no severity at all, in which case the update counts as critical. v3.3 also warns that a single update fixing several issues must go in within 14 days if any one of them is critical or high risk.
Three more rules sit around the clock. All in-scope software must be licensed and supported, and the vendor must state the future date when fixes stop. Unsupported software must be removed, or taken out of scope in a sub-set that blocks all traffic to and from the internet. Automatic updates must be on where possible.
A calendar shows why the rule bites. Microsoft publishes its monthly security update on the second Tuesday of each month. The 10 November 2026 release must be in by 24 November, as our November 2026 Patch Tuesday guide sets out. The January 2027 release falls on 12 January, so its deadline is 26 January 2027, the same day the reported Willow Plus window closes. It is also the last regular update for Windows Server 2016, whose extended support ends that day. February's release on 9 February must be installed by 23 February. A laptop switched off through a fortnight of leave can push you over the line.
The NCSC's July 2026 Pathways post admits many organisations still struggle with the 14-day requirement and says it will work with DSIT on any future consultation about the control set. That is monitoring, not a sign the rule is going.
Scope changes that catch SMEs and MSPs out
Legal entities. You must list every legal entity in scope with its name, address and company number, and they appear on the digital certificate platform. You can request an individual certificate for each entity in a group scope for a small extra charge; it will show that it is part of the wider scope.
Out-of-scope areas. You must describe what is excluded, justify it and explain how excluded networks are segregated. That description is not published. The scope description itself is no longer length-limited and is visible through the digital certificate.
End-user devices. v3.3 says a scope without end-user devices is not acceptable. Staff-owned (BYOD) devices that access organisational data or services are in scope, except phones used only for native voice, native text or MFA apps.
Home working. Corporate and BYOD devices used at home are in scope. A router you give a home worker is in scope; other home routers are not, so the device needs its own software firewall.
Third parties and MSPs. Every account your organisation owns is in scope, even when a supplier, contractor or MSP uses it to run your infrastructure. If you use externally managed services, you must be able to confirm the controls are met and show it in your answers. Devices owned by an MSP administrator are out of scope; the accounts that administrator uses on your systems are not. On our reading, the same applies to offshore developers or support teams working in your tenant.
Software development. Publicly available commercial web applications are in scope by default; bespoke and custom components are out of scope, and v3.3 points developers to the Software Security Code of Practice.
Point in time and ongoing compliance. The point in time is the date the certificate is issued, so systems must be supported on that date. The director's declaration now accepts responsibility for keeping every control in place for the whole certification period, which IASME sets at 12 months.
Cyber Essentials Plus under Danzell: retests and the Willow cutoff
Plus uses the same five controls and adds a technical audit. IASME says it covers a representative set of user devices, all internet gateways and all servers with internet-facing services, and that the verified self-assessment is a prerequisite. The Plus audit must be completed within three months of your last basic certification.
Two Danzell-era rules change how the audit plays out:
- Retests sample new devices. If the first random sample fails on update management, you remediate and the assessor retests both the original sample and a fresh random sample. A second failure revokes the verified self-assessment certificate, so you lose basic Cyber Essentials as well.
- No editing the self-assessment after testing. The verified self-assessment must be finalised and unchanged before Plus testing begins.
The NCSC's current audit method is still the Cyber Essentials Plus Test Specification v3.2, dated 28 April 2025. Cyber Strategies, a certification body, says a Plus audit follows the question set used for the online assessment, so a Willow basic certificate leads to a Willow Plus audit.
On the cutoff, the same body gives 26 January 2027 as the last date for a Willow-based Plus audit. That fits IASME's two published rules: six months for Willow accounts opened before 27 April 2026, then three months for Plus. IASME has not printed the date itself, so treat 26 January 2027 as the outer limit, book your assessor now and confirm the date in writing with your certification body.
Fees, funding and insurance for 2027
IASME prices basic Cyber Essentials by headcount; the list prices below were on its scheme page on 11 November 2026. Plus is quoted by the certification body according to the size and complexity of your network.
| Organisation size | Cyber Essentials list price | With First Step Fund (75% off) | Cyber Essentials Plus |
|---|---|---|---|
| 0 to 9 employees | £320 + VAT | £80 + VAT | Quote from certification body |
| 10 to 49 employees | £440 + VAT | £110 + VAT | Quote from certification body |
| 50 to 249 employees | £500 + VAT | £125 + VAT | Quote from certification body |
| 250 or more employees | £600 + VAT | Not eligible | Quote from certification body |
The discounted column is our arithmetic: 25% of each list price, for example £440 × 0.25 = £110. The First Step Fund, announced on 3 November 2026, covers UK-based organisations with fewer than 250 employees that are certifying for the first time or have not held a certificate in the last four years. You must buy the assessment by 31 March 2027, or before the funding runs out, so do not leave it to the last day; you then have six months to submit it. The discount still applies if you go through a certification body.
The second offer, the Cyber Resilience Pledge grant, fully funds certification plus support from an NCSC-assured Cyber Advisor for SME suppliers nominated by organisations that have signed the government's Cyber Resilience Pledge. IASME says the first allocation needs assessments submitted by 15 March 2027; GOV.UK says the grant runs until the end of March 2029.
There is also an insurance benefit. UK organisations with turnover under £20 million that certify their whole organisation are entitled to free cyber liability insurance arranged by IASME, including a 24-hour incident helpline and incident response up to a total liability limit of £25,000.
Worked example: a 35-person firm with an outsourced MSP
Take a UK professional-services firm with 35 staff, 35 Windows laptops, 20 BYOD phones that open Outlook and Teams, a head-office firewall, Microsoft 365, a cloud accounting package, a CRM and a payroll portal. An MSP manages the laptops remotely. The firm has never held Cyber Essentials and wants it for a public-sector bid.
Fee. The 10 to 49 band is £440 + VAT. As a first-time UK SME buying by 31 March 2027, the First Step Fund cuts that by 75%: £440 × 0.25 = £110 + VAT. A firm certified within the last four years would pay the full £440 + VAT.
MFA inventory. Four cloud services are obvious. A proper inventory usually finds more: the MSP's ticketing portal (if staff log in with a work email), a file-transfer service one team uses, and a recruitment platform. Each needs MFA on if the vendor offers it at any tier; if the recruitment platform sells MFA only on a higher plan, the firm pays for that plan or moves off it before submitting.
Patching window. If the firm buys in early January 2027, the January release lands on 12 January and must be on every laptop by 26 January. Two laptops belonging to staff on leave are the classic failure. The fix is an MSP policy that forces installation on next connection, plus a report of any device more than 10 days behind.
MSP accounts. The MSP's admin accounts in the firm's Microsoft 365 tenant and on the firewall are in scope and need MFA, separation from day-to-day accounts and removal when no longer needed. The MSP's own laptops are out of scope.
Timeline. IASME allows up to six months after purchase and says an assessor reviews answers within three working days. If the bid also asks for Plus, the audit follows within three months, and the retest rule means patching the whole fleet, not a sample.
Decision table: which route fits
| Your situation | Route | Why |
|---|---|---|
| UK SME, never certified, under 250 staff | Basic Cyber Essentials through the First Step Fund by 31 March 2027 | Lowest published cost; 75% off |
| Supplier to a Cyber Resilience Pledge signatory | Ask the buyer to nominate you for the Pledge grant | Fully funded certificate plus Cyber Advisor support |
| Bidding for central government or NHS work handling personal data or OFFICIAL-level ICT | Cyber Essentials as a minimum; Plus if the tender asks | PPN 014 tells those buyers to require it or equivalent controls |
| Certified on Willow in the last three months and need Plus | Book the Plus audit for no later than 26 January 2027 | Reported Willow cutoff; after that, recertify on Danzell |
| Windows Server 2016 hosts still in scope | Migrate, buy Extended Security Updates, or isolate by 12 January 2027 | Unsupported software in scope must go |
| Legacy systems that cannot meet 14-day patching | Isolate them in a sub-set with no internet traffic, or replace them | Late critical patches fail the assessment |
| Large organisation with alternative controls | Ask the NCSC about Cyber Essentials Pathways | Alternative route to Plus; higher cost |
| MSP serving many clients | Standardise MFA and patch evidence per client tenant | Client accounts you use are in their scope |
PPN 014, published by the Cabinet Office in February 2025, replaced PPN 09/14 and PPN 09/23. It covers central government departments, their executive agencies, non-departmental public bodies and NHS bodies, and tells them not to require Cyber Essentials as a blanket rule. The NCSC describes Pathways as an alternative route to Plus for organisations whose controls differ from the standard model, at a higher cost. For Windows Server 2016, see our migration playbook. Microsoft's paid updates have published end dates up to January 2030, which matches the v3.3 definition of supported software; confirm with your certification body.
Remediation checklist for SMEs
- List every cloud service that stores or processes your data and is reached with a work email or company credentials, free tools included.
- Turn on MFA wherever it exists, at any price tier. Record the method. Prefer passkeys, FIDO2 keys or app-based prompts over SMS.
- Separate admin accounts. No email or web browsing from admin accounts. Remove admin rights that are no longer needed.
- Set the patch clock to 10 days, not 14. Enable automatic updates. Track operating systems, browsers, runtimes, plug-ins and router or firewall firmware.
- Treat no stated severity as critical. v3.3 does.
- Remove or isolate unsupported software. Confirm each vendor publishes a future end-of-support date. Windows 10 PCs not covered by Extended Security Updates need a decision now; our Windows 10 refresh plan sets out the options.
- Bring every end-user device into scope, including BYOD phones that open work email. Where a PIN only unlocks the device, use at least 6 characters, and lock after no more than 10 failed attempts or throttle guesses.
- Fix firewall basics. Change default admin passwords. Keep the admin interface off the internet unless there is a documented need and MFA, or an IP allow list plus a managed password, protects it. Document every inbound rule with its business reason and approver.
- Check passwords without MFA. Use either a 12-character minimum, or 8 characters plus automatic blocking of common passwords. Do not force regular expiry or complexity rules.
- Confirm malware protection is active on every Windows and macOS device, or use application allow-listing.
- Write down exclusions and how they are segregated, and list every legal entity with its company number.
- Brief the signing director that the controls must hold for the whole certification period, not just on submission day.
Remediation checklist for MSPs
- Inventory every account you hold in each client's estate, including remote monitoring agents, firewall logins and cloud admin roles. They are in the client's scope.
- Enforce MFA on all of them, and on any portal where client staff log in with a work email.
- Publish a patch service level under 14 days for critical and high updates, with a per-client report showing device-level compliance and exceptions.
- Patch the whole fleet before a Plus audit. Retests now draw a fresh sample, and a second failure revokes the client's basic certificate.
- Produce an evidence pack per client: cloud service list with MFA status, patch report, unsupported-software register, and firewall rule register with business reasons.
- Show your own controls. Clients must be able to confirm the controls are met where services are externally managed, and IASME's certificate search lets them check whether you are certified.
What to watch before April 2027
IASME says the scheme is reviewed every year with the NCSC, and last cycle the requirements preview came in November 2025, ahead of the April 2026 switch. As of 12 November 2026, the NCSC resources page still lists v3.3 and the Plus test specification v3.2, and IASME's Cyber Essentials articles show the 4 November funding announcement but no new requirements or question set. If the pattern holds, expect a preview this winter and a new question set name. For how Cyber Essentials sits beside ISO 27001 and SOC 2 in buyer questionnaires, see our comparison.
Also watch the Pathways rollout for large organisations, any DSIT consultation on the control set, and the First Step Fund, which closes at the end of March 2027 or when the money runs out.
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our cybersecurity services team can build the cloud-service and MFA inventory, the 14-day patch reporting and the evidence pack you take to a licensed certification body, which alone issues the certificate. Talk to us at /contact-us/.
Last updated: 12 November 2026.
