Cyber Essentials (+ Plus)
for Creatives

Cyber Essentials is a UK government-backed certification scheme managed by the NCSC and delivered through IASME-accredited bodies. It certifies that an organisation has five core technical controls in place: firewalls, secure configuration, access control, malware protection, and patch management. It is the minimum cyber security standard recommended by the UK government for all organisations, and is mandatory for many public sector contracts.

The four most significant changes under Danzell are: mandatory MFA for all cloud services that offer it, with automatic failure if it is not enabled; a 14-day patching requirement for high and critical vulnerabilities, which is now an auto-fail if not met; a broadened definition of cloud services, including social media accounts accessed through organisational logins; and a new director declaration that makes board-level sign-off a commitment to ongoing compliance rather than a one-time statement.

Under Danzell, yes. The updated definition of cloud services explicitly includes social media accounts accessed through an organisational login. If your business uses LinkedIn, Instagram, or similar platforms via company credentials, they fall within scope and MFA must be enabled. This is a notable change from the previous question set, where peripheral SaaS platforms could often be excluded.

A single missed high or critical vulnerability that is more than 14 days old is an automatic failure under Danzell. This applies to operating systems, firewall firmware, and applications on devices within the assessment scope. Under CE Plus, a failed sample can be remediated once, but a second sample failure has no further remediation window. The practical implication is that patch management needs to be consistent and documented before the assessment account is opened, not cleaned up once the process is underway.

No. Cyber Essentials focuses on five specific technical controls that guard against common, automated cyber attacks. ISO 27001 is a comprehensive information security management standard covering governance, risk management, policy, and operational processes across an entire organisation. CE is a technical baseline. ISO 27001 is a broader management system. Some organisations pursue both; CE is typically the starting point.

The director declaration is a formal sign-off required from a board member or director at the end of the self-assessment. Under Danzell, it has been significantly strengthened. It now includes an explicit commitment to maintain Cyber Essentials controls throughout the 12-month certification period, not just as of the assessment date. This moves Cyber Essentials compliance from a periodic exercise into an ongoing obligation with named executive accountability.

Yes. All assessment accounts created on or after 26 April 2026 must use the Danzell question set. If your current certificate was issued under the previous Willow requirements, your next renewal will be assessed against the Danzell criteria. That means your systems need to meet the stricter MFA, patching, and cloud scoping requirements before you open your next assessment account. We recommend starting preparation at least eight to ten weeks before your renewal date.

Cyber Essentials is a verified self-assessment. You answer a structured question set and an external vulnerability scan is carried out. Cyber Essentials Plus includes everything in the standard certification plus an independent hands-on technical audit of your actual systems, carried out by an accredited assessor. CE Plus provides a higher level of assurance and is increasingly required by enterprise clients and in formal procurement processes.

It depends on how close your current systems are to the requirements. Organisations that are well-prepared can complete the process in a matter of days. Those with gaps in MFA, patching, or device management typically need several weeks of remediation before they are ready to open an assessment account. We carry out a review of your setup against the Danzell requirements before any assessment begins, so you know what needs to be fixed first.

Yes. Under Danzell, if a cloud service offers multi-factor authentication and it is not enabled for all users, the assessment is an automatic failure. This applies to admin accounts and standard user accounts. It covers any cloud service accessed through an organisational account, including email platforms, file storage services, and collaboration tools. Passwordless methods such as passkeys and FIDO2 can meet the MFA requirement where they involve more than one factor.

The NCSC has assessed it as almost certain that AI-enabled tools will improve attackers’ ability to exploit known vulnerabilities by 2027. Cyber Essentials is specifically designed to address commodity-level attacks, which is the category AI tools are accelerating. The controls do not protect against sophisticated, targeted threats, but they close the gaps that automated scanning and exploitation tools look for first. For most agencies, practices and studios, that is where the actual risk sits.

Danzell is the updated self-assessment question set for Cyber Essentials, introduced by IASME and the NCSC on 27 April 2026. It replaces the previous Willow question set and applies version 3.3 of the NCSC Requirements for IT Infrastructure. The five core controls have not changed, but the assessment is stricter. Several areas previously treated as non-conformities are now automatic failures, including MFA gaps and missed patches.

We review your current IT setup against the Danzell requirements, identify the gaps, and fix them before you open an assessment account. That covers MFA rollout across cloud platforms, patching gap analysis, scoping documentation, removal or isolation of unsupported software, and any configuration work required. After certification, we provide ongoing support to keep systems at the certified standard through the 12-month period. We do not carry out the CE Plus assessment itself. Certification is conducted by an accredited assessor. Our role is to make sure you are ready to pass.

Mixed device estates, remote working, and freelancers using personal devices are among the most common sources of complexity for agencies going through CE Plus. Each device within the defined scope needs to meet the same patching, MFA, and configuration requirements. Freelancer devices on company networks need to be either included in scope and managed accordingly, or excluded from scope with a clear technical justification. We work through these questions as part of our preparation support, so they are resolved before the assessment opens.

Yes. Both Cyber Essentials and Cyber Essentials Plus certificates are valid for 12 months. You must renew annually to maintain certification. If your current certificate was issued under the previous Willow requirements, your next renewal will be assessed against the stricter Danzell criteria. We recommend beginning preparation at least eight to ten weeks before your renewal date.

Double sampling is a new CE Plus process introduced under Danzell. If the assessor finds a patching failure during the audit, they are required to test a second independent sample of devices from across the estate, rather than retesting only the failing device. This is designed to catch selective patching, where organisations apply updates to sampled devices but not consistently across their full IT environment. A second failure following the additional sample revokes the CE Plus certificate.

Cyber Essentials is mandatory for many UK government contracts, particularly those involving the handling of personal data or the provision of certain ICT products and services. Architecture practices and agencies working in public sector supply chains or tendering for government-connected work should treat it as a baseline requirement, not an optional extra. Cabinet Office procurement policy makes this an expectation across an expanding range of contract types.