This Cyber Essentials v3.3 pack is the documented position behind a Cyber Essentials self-assessment under the Danzell question set, published in February 2026. 25 editable Word and Excel documents, downloadable the moment you check out. On this page:
- What is in the toolkit
- What Cyber Essentials v3.3 Danzell changed, and what now fails you outright
- Who needs Cyber Essentials v3.3
- How the documents map to the framework
- Frequently asked questions
- Related toolkits
What is in the Cyber Essentials v3.3 pack
Cyber Essentials is answered as a questionnaire, but the answers have to be true and, for Cyber Essentials Plus, demonstrable. The pack provides the policy and register behind each of the five technical controls:
- Firewalls and internet gateways – boundary firewall configuration standard and rule review register
- Secure configuration – build standards for servers, workstations and mobile devices, and a default credential removal record
- User access control – account management policy, privileged account register, and the multi-factor authentication policy covering all cloud services
- Malware protection – anti-malware standard and allow-listing position
- Security update management – the patching policy built around the 14 day rule, plus a software inventory and an end-of-life software register
- Supporting documents – asset inventory, BYOD and home working position, cloud service register, incident response basics and an awareness briefing
- Assessment support – a self-assessment preparation workbook and, for Cyber Essentials Plus, the evidence pack an assessor samples against
What Cyber Essentials v3.3 Danzell changed, and what now fails you outright
IASME published the Cyber Essentials v3.3 requirements and the Danzell question set in February 2026. It applies to assessment accounts created after 26 April 2026, with a six month grace period for accounts created before that date.
Two changes carry real teeth. Multi-factor authentication is now mandatory for all cloud services, not just administrative accounts – which catches organisations running a long tail of SaaS tools nobody owns. And questions A6.4 and A6.5 are auto-fail: miss the 14 day patching requirement for high or critical severity updates and the assessment fails, regardless of how the rest is answered.
That is why the patching policy and the software inventory in this pack are treated as primary documents rather than supporting ones. A Cyber Essentials v3.3 submission stands or falls on whether you can say, truthfully, what software you run and how quickly you patch it. Scheme detail is published by the NCSC.
Who needs Cyber Essentials v3.3
UK organisations bidding for government contracts, where Cyber Essentials is a standing procurement requirement and Cyber Essentials Plus is increasingly asked for instead. Suppliers in a government supply chain being asked to certify. Small and medium organisations who want a credible baseline without committing to ISO 27001. And organisations renewing whose previous certification was answered against the older Willow question set.
How the Cyber Essentials v3.3 maps to the framework
The five controls are simple to state and awkward to evidence, which is where most first attempts come unstuck. The pack pairs each control with the register that proves it – a firewall rule review log, a privileged account register, a software inventory with end-of-life flags – because the Plus assessment samples against reality rather than reading the policy.
Frequently asked questions
What is Danzell?
The name of the current Cyber Essentials question set, published February 2026 alongside the v3.3 requirements. It supersedes the previous set, Willow.
When does v3.3 apply to us?
To assessment accounts created after 26 April 2026. Accounts created before that date had a six month grace period.
What are the auto-fail questions?
A6.4 and A6.5, covering the 14 day patching requirement for high and critical severity updates. Failing either fails the assessment outright.
Is MFA really required everywhere now?
For all cloud services, yes – not only administrative accounts. This is the change that most often requires actual work rather than documentation.
Does this cover Cyber Essentials Plus as well?
Yes. Plus is the same five controls with an assessor testing them hands-on, so the pack includes the evidence set that testing samples against.
Related toolkits
Cyber Essentials is often the first step rather than the destination. See the ISO 27001 Toolkit for a full certifiable ISMS, the CIS Controls Toolkit for a deeper technical baseline, the NIS2 Toolkit for EU obligations and the GDPR Toolkit for data protection records.
Implementing for clients? The Consultant Package licenses all 86 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.
Delivery, format and licence
Your Cyber Essentials v3.3 downloads immediately after checkout as native Microsoft Word and Excel files. Nothing is watermarked or locked, so you can rebrand the documents, bring them under your own document control and revise them for as long as you need them.
One-time purchase. No subscription and no annual renewal. Because the source files are yours, revising a procedure after an audit finding or a change of scope is an internal edit rather than another purchase.
Reviews
There are no reviews yet.