Danzell: the 2026 Cyber Essentials question set

Anyone seeking Cyber Essentials certification has to complete a self-assessment questionnaire. Since April 2026, the version in force has been called Danzell. Getting to know the questions in advance is one of the most practical ways of finding out what the business already complies with and what is still missing, even for those who do not intend to certify.

What Danzell is

The IASME Consortium, the NCSC's partner in running Cyber Essentials, periodically updates the question set used in the assessment. Each version is given a name: Evendine, Montpellier, Willow and, for 2026, Danzell (version 16.2). The questions reflect the requirements of the document Cyber Essentials: Requirements for IT Infrastructure, version 3.3.

The questionnaire is completed on IASME's online platform, and the answers are reviewed by an assessor from a certification body. At the end, a representative of the organisation signs a declaration confirming that the information provided is true.

How the question set is organised

The questions follow the same logic as the scheme: first, the business introduces itself and defines what will be assessed; then it answers questions on each of the five technical controls.

• Organisation: company details, number of employees, main activity and whether the application is a renewal.
• Scope of the assessment: which equipment, operating systems, networks and cloud services are included, with the make and operating system version of each type of device.
• Insurance: questions about the cyber liability insurance offered to UK-based organisations that meet certain criteria.
• Firewalls: protection of the network and devices, administrator passwords and services exposed to the internet.
• Secure configuration: removal of unnecessary software and accounts, default passwords and how devices are unlocked.
• Security update management: licensed software supported by the manufacturer, with updates applied within the required timeframes.
• User access control: individual accounts, administrator privileges and multi-factor authentication on cloud services.
• Malware protection: the solutions used on each type of device.

Each question comes with guidance explaining what is expected in the answer, often with examples and a reference to the corresponding requirement.

Why it helps to know the question set in advance

Reading Danzell before starting the assessment lets you use it as a diagnostic tool. Each question is, in practice, a checklist item:

• Identify gaps. Questions the business cannot answer with confidence show where the problems are.
• Organise the inventory. The questionnaire asks for a list of equipment, operating systems, browsers, anti-malware solutions and cloud services, with versions.
• Talk to your IT provider. The questions turn technical requirements into concrete points to raise with whoever manages the systems.
• Use it as a roadmap, even without certifying. Any business, in the UK or elsewhere in Europe, can adopt the questions as a checklist, even if it does not intend to certify.

Before you answer

• Define the scope: which sites, networks and equipment will be assessed.
• Build the inventory with the make and operating system version of each type of device.
• List software and cloud services and confirm that they are licensed and supported.
• Check that multi-factor authentication is enabled on all cloud services.
• Read the guidance for each question before answering.

Download the question set

Danzell is available here in two versions, both as Excel spreadsheets:

The English version is the document published by the IASME Consortium. The Portuguese translation is provided for study purposes: in the event of any discrepancy, the original text prevails. In the assessment itself, the questionnaire is answered on the IASME platform, in English.