CYBER ESSENTIALS
E M E R G I N G R I S K S G L O B A L
CYBER ESSENTIALS
Show you’re serious about cyber security and reduce security incidents by achieving Cyber Essentials with ERG
Cyber Essentials is the UK Government-backed scheme that sets the baseline for cyber security. It is mandatory for a growing list of public sector and defence contracts and commercial buyers increasingly require it before adding you to a supplier list.
Emerging Risks Global is assured by the National Cyber Security Centre to deliver Cyber Security Consultancy in Risk Management and we are also licensed to assess and award Cyber Essentials, not just to advise on it.
​
​
​
​
​
​
​Cyber Essentials has been a condition of certain central government contracts since 2014 and the Ministry of Defence applies its own cyber requirements to defence suppliers through DEFCON 658 and the Cyber Security Model.
​
The scheme changed in April 2026. Here is what it means for you.
​
In April 2026, the Willow question set was replaced by a new set called Danzell, aligned to version 3.3 of the requirements.
​
The five controls have not changed. Enforcement has. Danzell introduces automatic failure criteria, most notably for multi-factor authentication on cloud services and security update management. It also brings a new definition of cloud services and changes to scoping, certification transparency, backups, user access control and application development.
​
If you started an assessment under Willow, the clock is running.
​
Assessment accounts created before the cutover are still assessed under Willow, but they must be finalised by 26 October 2026. Cyber Essentials Plus assessments built on a Willow submission run to 26 January 2027. Miss those dates and you start again under Danzell.
​
Every new assessment account opened now uses Danzell.
​​​​
Answers that passed under Willow will not automatically pass under Danzell. If your last certification was a paperwork exercise, this is the year that shows.
​Certification also includes cyber liability insurance for UK and Crown Dependencies organisations with turnover under £20m, where the certification covers the entire organisation and you opt in during the application. The cover is £25,000 limit of indemnity with a 24/7 incident response line.
​​​
How certification works with us
​
Step 1: Scoping call
​
Thirty minutes. We establish what is in scope, which level you need and whether anything in your estate is going to cause a problem. No charge.
​
Step 2: Readiness check
We assess you against the current question set before you commit to a submission, and give you a written gap list with the remediation in priority order. This is where most of the value sits.
​
Step 3: Submission and assessment
You complete the assessment in the IASME portal. We review it as your Certification Body and get back to you with a pass or a defined set of things to fix.
Step 4: Certificate
You are issued with your certificate and it is listed on the IASME certificate search so buyers can verify it. Certification runs for twelve months and must be renewed annually.
​
Why come to ERG
​
We are a converged security consultancy. Cyber sits alongside physical security, personnel security and technical security in everything we do, because that is how attacks actually work.
​
That matters in practice. If your Cyber Essentials assessment surfaces a user access problem, we can tell you whether it is a technical control failure or an insider risk problem. If you are certifying because a defence contract demands it, we can see the rest of the contract's security conditions at the same time.
GET CYBER ESSENTIALS
As an IASME-licensed Certification Body, ERG is authorised to assess against the scheme and to support your organisation through certification.
Win More Business
Certification is a hard requirement for a growing number of public sector, defence and enterprise tenders. Without it you are screened out before anyone reads your bid.
Improve Your Security
You will gain a clear picture of your current cyber security posture, with every important process and policy formally documented to ensure business continuity.
Cyber Liability Insurance Included
Certification includes £25,000 of cyber liability cover with a 24/7 incident response line, subject to eligibility.
Proven to Work
The NCSC reports that organisations with the Cyber Essentials controls in place are 92 per cent less likely to make a claim on cyber insurance.
