What changed in Danzell and Requirements v3.3

Assessment accounts created from 27 April 2026 use the NCSC's Requirements for IT Infrastructure v3.3 and IASME's Danzell question set. The five controls are unchanged. The biggest practical changes are in how strictly two existing rules are marked: multi-factor authentication (MFA) on cloud services, and installing critical or high-risk updates within 14 days. Both are now automatic fails. Cyber Essentials Plus also has a new process for missing updates found during the audit.

Where Danzell fits

The requirements are revised every year, and each question set has a name. Montpellier (v3.1) applied from April 2023 and Willow (v3.2) from April 2025. Danzell (v3.3) replaced Willow in April 2026. Accounts opened before the change were finished against Willow within the usual six-month window, so by now every new assessment is on Danzell.

Changes in the requirements document

The NCSC lists these as new in v3.3:

• A definition of a cloud service. In short: an on-demand, scalable service on shared infrastructure, reached over the internet through an account, that stores or processes your organisation's data. That includes free tools staff sign up to with a work email.
• Cloud services cannot be excluded from scope. This was already the intent; v3.3 now says it in so many words. See Cloud services are always in scope.
• FIDO2 is named in the definition of passwordless authentication. FIDO2 authenticators are treated as passkeys and count as MFA. See Passwords and passkeys.
• The scope conditions no longer mention "untrusted" connections. A device is in scope if it can accept connections from internet-connected devices, make outbound connections over the internet, or control the flow of data between the two. Trusted inbound connections now count too.
• The Software Security Code of Practice is referenced in the software development section.
• Backups get more emphasis. Backing up is still not a requirement, but the NCSC strongly recommends it.

Changes in how answers are marked

Cloud MFA is an automatic fail

Requirements v3.3 says authentication to cloud services must always use MFA. IASME has confirmed that under Danzell, a cloud service that offers MFA in any form, free or paid, built in or through another service, but does not have it switched on, is an automatic fail. This applies to questions A7.14 to A7.17. A service that genuinely offers no MFA must be listed (A7.15), and the assessor checks that claim. See MFA for cloud services.

Late critical and high updates are an automatic fail

The 14-day rule itself has not changed: updates that fix vulnerabilities the vendor rates critical or high, or that score 7 or more on CVSS v3, or that come with no severity rating, must be installed within 14 days of release. Under Danzell, the questions on this for operating systems and firmware (A6.4) and for applications (A6.5) are automatic fails. See The 14-day update rule.

Remember that any answer showing you do not meet a requirement fails the assessment anyway. Automatic fail means there is no room for the assessor to treat it as a minor point. See Automatic fail questions.

Changes to Cyber Essentials Plus

• Fix everything before the audit. Any non-conformity in the self-assessment must be resolved before Plus testing starts, and you cannot go back and change your self-assessment answers based on what the audit finds.
• Remediation across the whole scope. If the first sample shows missing updates, you have a set period to fix them on every in-scope device, not just the sampled ones.
• A second sample checks the fix. If the same vulnerabilities are found again, you fail Plus and the underlying Cyber Essentials certificate is revoked.

See The three-month window for Plus.

What to do now

1. Turn on MFA for every cloud service that offers it, for every user and admin account.
2. Check that operating systems, firmware, browsers, extensions and applications are all receiving updates within 14 days.
3. List your cloud services in full, including ones staff signed up to themselves.
4. If you plan to take Plus, run your own authenticated scan before the audit.

To check your setup against the Danzell rules, use the readiness checker.