Willow Has Closed: Cyber Essentials Under Danzell

Cyber Security | Emerging Risks Global

Why the end of the Willow window turns good intentions into pass or fail questions

Cyber Essentials has always been a short list of controls. What changed this year is how much room an organisation has to be nearly right.

Since 26 April 2026, new Cyber Essentials assessment accounts have been assessed against version 3.3 of the requirements, through the Danzell question set (IASME). Organisations that opened an account before that date were given six months to finish under the previous requirements and the Willow question set. That window closed on 26 October 2026. From now on, every organisation working towards Cyber Essentials is assessed under Danzell.

The Controls Have Not Changed but the Margin Has

The five technical controls remain the same. The difference lies in how some answers are now treated. Several questions that once invited explanation now decide the outcome on their own.

Multi-factor authentication is mandatory for all cloud services where it is available, and failing to implement it is an automatic fail (IASME). The questions on security updates for operating systems, router and firewall firmware and applications are now automatic fails too. Critical or high-risk updates must be installed within 14 days of release.

Cloud Services Sit Inside the Boundary

Cloud services can no longer be excluded from scope, and any exclusion has to be justified. For many organisations this is the larger change. Email, file storage, finance systems and collaboration tools often sit with a provider rather than in a server room. The accounts that reach them still belong to the organisation and still form part of its attack surface.

Scope descriptions can now be more detailed, out-of-scope areas must be documented and every legal entity in scope must be listed.

A Certificate That Looks Forward

The point in time for the assessment is now the date the certificate is issued, so systems must be supported on that date. The board or director declaration also now acknowledges responsibility for ongoing compliance throughout the certification period. Certification is no longer a snapshot that can be prepared for once and then left alone.

What Organisations Should Check Now

• Does every cloud service in use offer multi-factor authentication, and is it switched on for every user?

• Can the organisation show that critical and high-risk updates are applied within 14 days?

• Is every legal entity and cloud service in scope identified, with any exclusion justified?

• Will every device and system in scope still be supported on the day the certificate is issued?

• Does the board understand that its declaration covers the whole certification period?

An assessment started under Willow and left unfinished now has to begin again under Danzell.

How ERG Can Help

ERG is an IASME-licensed Certification Body and can assess and award Cyber Essentials, not only advise on it. A free 30-minute scoping call and a readiness check with a prioritised gap list come before submission. Details are on ERG's Cyber Essentials page, or contact information@emergingrisksglobal.com.