Cyber Essentials Requirements 2026

Cyber Essentials is assessed against the Danzell scheme requirements. Danzell replaced the earlier Willow scheme on 26 April 2026 and is the version in force for every 2026 assessment submitted from that date onward. Willow ran from January 2022 to April 2026 and was the scheme that made MFA mandatory for all internet-facing accounts, tightened the patch management window, and set out how cloud services and personal devices are scoped — the requirements this article covers below.

Danzell carries those core requirements forward. If your organisation certified, or last reviewed its scope, under Willow, treat 2026 as a checkpoint rather than a rollover: confirm what applies now instead of assuming last year’s scope statement still holds. For the technical detail on what moved under each scheme, see our breakdowns of Cyber Essentials Plus v3.2 (Willow): What Changed and Cyber Essentials v3.3 Danzell: What Changed.

The IASME scoping guidance and the NCSC’s Cyber Essentials Requirements for IT Infrastructure document are the authoritative sources for both schemes. This article interprets and explains those requirements; organisations should review the current specification directly before assessment.

The scope boundary defines which systems, devices, and users the certification covers. Every device and service within that boundary must meet all five CE controls. Scope definition is where most first-time applicants run into problems, because the Montpellier scheme is explicit about cloud services and personal devices in ways the earlier scheme was not.

What is in scope by default

1. All end-user devices that can access internet-facing services: laptops, desktops, tablets, and smartphones, whether organisationally owned or personally owned if used for work.
2. All servers where the organisation manages the operating system and software configuration, including on-premises servers, cloud-hosted virtual machines, and containers.
3. Network devices that form the boundary between the organisation's network and the internet, and those within the internal network: routers, switches, firewalls.
4. Cloud services where the organisation controls the configuration above the infrastructure layer: Microsoft 365 tenancies, Google Workspace tenancies, and AWS or Azure instances with organisation-managed operating systems.

Cloud services: scope follows control

This is the most frequently misunderstood aspect of current CE requirements. The principle is straightforward: if your organisation configures and manages a service, it’s in scope. If a service’s infrastructure and configuration is entirely controlled by the provider, the underlying infrastructure may be out of scope.

But the key word is infrastructure.

1. In scope: your Microsoft 365 tenancy, including Exchange Online, SharePoint, Teams, and the associated Azure Active Directory or Entra ID configuration. Your organisation controls account provisioning, MFA policy, conditional access, and device management settings within M365. That configuration is in scope.

2. In scope: AWS EC2 instances where your organisation manages the operating system and installed software.

3. Potentially out of scope: SaaS applications where the provider manages all infrastructure, OS, and patching. But your configuration of accounts, MFA enforcement, and data access controls within those platforms may still fall within CE requirements. 4. When in doubt: include the service in scope and verify controls are met. Excluding a service and later finding it should have been included creates a gap that may invalidate certification.

BYOD and home-working devices

Personally owned devices that access organisational systems may be in scope. The Danzell scheme is explicit: if a personal device directly accesses in-scope work services, and no technical control prevents that direct access, the device may fall within scope.

Three practical approaches exist: 

1. First, include BYOD devices in scope and verify they meet all five controls. This requires visibility and management capability over personal devices the organisation may not have.

2. Second, implement a technical control such as Virtual Desktop Infrastructure or a browser-based access solution that means the personal device never directly accesses in-scope systems. In that scenario, the personal device itself may be excluded.

3. Third, prohibit BYOD access to in-scope systems entirely and enforce that prohibition technically.

Organisationally owned devices used for home working are in scope and must meet all five CE requirements, including personal firewalls.

Scope tells you which systems are covered. This is what each of the five controls demands of them, in brief. For the reasoning behind each requirement, worked examples, and implementation guidance, see The 5 Cyber Essentials Controls Explained — this table is a summary, not the full walkthrough of what each control actually requires.

Standard CE and CE+ assess against the same five controls and the same technical requirements. The difference is not in what is required but in how compliance is verified.

Supported software is software for which the vendor is still releasing security updates. The definition is simple; the practical implications catch organisations out. 1. Windows 10 reached end of support in October 2025. Devices still running Windows 10 are already out of CE compliance. Organisations with Windows 10 in scope needed to complete migration to Windows 11 or an alternative supported OS before that date. 2. Third-party applications that have reached end-of-life fail the supported software requirement regardless of whether all other CE requirements are met. 3. The supported software check applies to firmware on network devices and servers, not only to installed software. 4. There is no grace period. The date a vendor ends support is the date from which that software is out of compliance.

Before submitting a CE self-assessment, work through these questions. A “no” or “uncertain” answer is a remediation item, not a question to navigate carefully in the Cyber Essentials questionnaire. 1. Have all devices in scope been identified and documented, including cloud services and remote-working devices? 2. Is all software on in-scope devices currently supported by its vendor, with security updates still available? 3. Have critical and high-severity patches been applied within the last 14 days across all in-scope systems? 4. Have default credentials been changed on all network devices, hardware, and software? 5. Is MFA enforced for all accounts that can access internet-facing services, including Microsoft 365 and any cloud applications? 6. Are administrative accounts separate from standard user accounts, with no unnecessary admin accounts active? 7. Is anti-malware installed and actively maintained on all in-scope devices, or is application allowlisting in place? 8. Are personal firewalls enabled on all laptops and mobile devices used outside the office network? 9. Do you have a complete, current software inventory for all in-scope devices?

Once you’ve worked through this list, the next step is filling in the questionnaire itself. Our guide, How to Complete the Cyber Essentials Questionnaire, walks through each section and the evidence assessors expect to see.

1. The Danzell scheme, in force from 26 April 2026, is the requirements framework for CE assessments from that date. Willow applied from January 2022 to April 2026.
2. All five controls must be met across every system within scope.
3. MFA must be enforced on all internet-facing accounts without exception.
4. Windows 10 reached end of support in October 2025. Devices still running it are already out of CE compliance.
5. The 14-day patch window applies to everything on in-scope devices.
6. CE+ does not apply different requirements — same requirements, independent technical verification instead of self-assessment.