Joe White l 14th October 2026

Cyber Essentials Plus in 2026: What Danzell Changed

It has now been six months since Danzell was introduced to Cyber Essentials. The updated question set has brought significant changes to the certification process, with increased focus on patch management, multi-factor authentication (MFA), asset management, and assessment readiness. In this blog, we explore what has changed, where organisations are most commonly falling short, and the key steps you should take before starting your assessment.

‍Scope and software

Most failures trace back to this. The starting point is an accurate picture of the networks, devices and services actually in use, which the self assessment requires in any case. Cloud services are firmly in scope, so anything holding organisational data counts, including email, productivity suites and admin portals. Partial scoping is still permitted, but exclusions have to be justified to the assessor.

The other half of the job is software. It tends to be the forgotten installs that cause problems: an old browser extension, a free PDF tool, an application added temporarily two years ago and never removed. The inventory comes first, then a pass through it to confirm every item is either current or still supported. Anything out of support will never receive another patch, which makes it a straight weak spot.

Patching and MFA

Danzell introduced two patching questions that are an automatic fail: one covering operating systems and router or firewall firmware, the other covering applications. In both cases, high risk and critical updates have to be applied within 14 days of release. Failing to meet either of these requirements will result in certification not being awarded. Firewalls, routers, and managed switches are often overlooked, so organisations must ensure patching extends beyond end-user devices and covers their wider infrastructure.

MFA is now mandatory on every cloud service that offers it, whether free, bundled or paid. Available but not enabled is another automatic fail.

The new Plus retest

This is the most significant change. Organisations could previously pass by patching only the devices in the sample. IASME has closed that off with double sampling.

The assessor will begin by testing a random sample of devices. If any high or critical vulnerabilities older than 14 days are identified, remediation must be carried out across the entire assessment scope, not just the devices that were tested. A follow-up assessment is then conducted using both the original sample and a new random selection of devices. If the same vulnerabilities are found again, the assessment will fail and the Cyber Essentials certificate may be revoked.

All of this happens inside a single 30 day window, there is very little notice of which devices land in the second sample, and there is no third attempt. Patching only the machines expected to be tested is no longer a viable approach, and a failure at that stage means starting again from the beginning, self assessment included.

The self-assessment must be completed and submitted before Cyber Essentials Plus testing begins, meaning it cannot be amended in response to findings during the audit. Organisations should ensure their responses accurately reflect their current security posture rather than their intended future state.

In summary

It's important to note - Danzell isn’t intended to catch out organisations with strong security practices already in place. Success comes down to understanding your scope, maintaining an accurate software inventory, keeping systems patched and supported, enabling MFA wherever possible, and carrying out an internal vulnerability scan before the assessment begins. Investing time in preparation can help avoid the additional cost, delay, and disruption that can arise when issues are discovered during the audit.