News

Cyber Essentials is changing.  The latest version of the certification framework, known as Danzell, introduces stricter requirements for both Cyber Essentials Basic and Cyber Essentials Plus.

The changes place greater focus on proactive security, patch management and multi-factor authentication (MFA), with assessors expected to take a much closer look at how businesses manage and maintain their IT environments.

For many organisations, these updates will increase the level of preparation required before certification or renewal.

What is changing under Cyber Essentials Basic?

One of the biggest changes relates to automatic failure scenarios.

Under the new requirements, organisations would fail the assessment if MFA is available on a cloud service but has not been enabled.  Businesses are now expected to explore alternative ways of implementing MFA, even where it is not built directly into the platform.

This may include integrating cloud services with solutions such as Microsoft Azure, Google Single Sign-On or other identity providers such as Okta.

The updated framework also introduces stricter patching requirements.  Previously, unsupported software was the main cause of automatic failure.  Under Danzell, businesses could fail if critical security updates are not applied within 14 days.

There is also a greater emphasis on assessment scope and documentation.  Businesses must now provide more detailed information on:

• Which systems and users are included in scope
• Any areas considered out of scope
• The legal entities covered by the certification, including company details and registration numbers

Cyber Essentials Plus assessments becoming more rigorous

The changes to Cyber Essentials Plus are expected to have the greatest impact.

Assessments will become significantly stricter, particularly around vulnerability management and device compliance.

If a random sample of devices fails the initial assessment, businesses will still have a 30 day remediation period to resolve the issues.  However, under the updated process, assessors will also test a new sample of devices during the retest, not just the original systems reviewed.

If this second sample set also fails, the result is an automatic failure of both Cyber Essentials Plus and the underlying Cyber Essentials Basic certification, meaning both are revoked.  Businesses do, however, have the option to accept the Plus failure after failing the first sample set in order to retain their Basic certification.

This means businesses will need to demonstrate that security updates and controls are being applied consistently across the wider IT environment, not only on selected devices.

The updated approach is designed to encourage organisations to actively maintain patching and security standards on an ongoing basis rather than preparing specifically for an audit window.

Why do the changes to Cyber Essentials matters for your business

Cyber Essentials continues to play an important role in helping businesses demonstrate their commitment to cybersecurity, protect sensitive data and meet supply chain or tender requirements.

However, the new Danzell framework means businesses will need a more proactive approach to cybersecurity and compliance.

Regular vulnerability scanning, consistent patch management, strong identity protection and ongoing monitoring will become increasingly important in achieving and maintaining certification.

At David Allen IT Solutions, we work closely with businesses to strengthen their security posture, identify risks early and support ongoing compliance requirements throughout the year.

From vulnerability management and patching processes to MFA implementation and audit preparation, our team provides practical support to help businesses approach certification with confidence.

If you would like support preparing for Cyber Essentials under the new Danzell requirements, contact our team today.

Send a message