An updated set of Cyber Essentials requirements and the new Danzell question set apply to assessments from today, replacing the Willow question set.
Key changes
- MFA is mandatory wherever it is available: not enabling it on cloud services now results in automatic failure.
- A formal definition of cloud services, which cannot be excluded from scope, and which includes social media accounts used for business.
- Failing to apply critical and high-risk security updates within 14 days is now an automatic failure.
- Tighter scoping rules for group certifications and for “whole organisation” certification where test and development environments exist.
- Cyber Essentials Plus: no major non-compliances permitted, and additional sampling of update management.
If your renewal is coming up, check your scope and your MFA and patching evidence now.
Source: Cyber Essentials Requirements for IT Infrastructure v3.3 (NCSC)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
