The Willow grace period ends on 26 October: why one forgotten cloud login now fails Cyber Essentials

On 26 October 2026, the six-month transitional window for the old Cyber Essentials Willow (v3.2) question set closes for good. Every UK business submitting or renewing after that date is marked under the v3.3 Danzell rules. Under Danzell, leaving Multi-Factor Authentication (MFA) switched off on a single cloud service that supports it is an automatic fail.

I have written before about how small firms trip over Cyber Essentials, usually by answering the form from memory rather than checking the machines first. What changed with Danzell is how little room you get to tidy up a mistake once the assessment starts, and where the assessors are now told to look.

Nobody forgets Microsoft 365. Everybody forgets the fifth tab.

When I run a security audit for a small business in London, the main email system is almost always locked down properly. Everybody has an authenticator app or a passkey on Microsoft 365 or Google Workspace, and the director assumes the cloud MFA box is ticked.

Then we look at what the staff actually open in a browser between nine and five. There is an accounting package, a CRM, a project board, a shared Canva or Adobe login, an HR holiday tracker, a trade supplier portal, and the company LinkedIn page. Under the old Willow rules, a gap on one of those secondary accounts could often be treated as a minor finding or left outside a narrowly drawn scope.

Danzell closed both doors at once. First, it defines a cloud service formally: any on-demand service hosted on shared infrastructure, accessed over the internet through an organisational account, that stores or processes your business data. Second, it states flatly that cloud services cannot be excluded from your assessment scope. If a tool holds company data and offers two-factor sign-in, every user on it must have MFA switched on before you submit.

The “paid add-on” excuse no longer works

Plenty of software vendors play an annoying game where basic password login is included in the starter plan, while two-factor authentication or Single Sign-On sits behind an enterprise tier at twice the monthly price.

IASME anticipated that argument in the v3.3 marking guidance. If a cloud service offers MFA at all, whether free, bundled, or sold as a paid upgrade, you have to enable it. Saying the vendor wanted an extra £8 per seat per month will not get you a pass. If you refuse to pay a vendor’s MFA tax, your only compliant move is to close the account and move the data to software that includes MFA in the base price.

One sensible change did arrive alongside the stricter marking. Danzell formally recognises FIDO2 passkeys and passwordless sign-in as valid MFA. You also do not need 14-character passwords across the board: where MFA protects a cloud account, an 8-character minimum with no maximum length cap satisfies the standard.

How Willow (v3.2) and Danzell (v3.3) compare at marking time

If your last certificate was issued in late 2025 or early 2026, the renewal form you face next month is judged differently in five places:

Area	Old Willow rules (ending 26 Oct 2026)	Current Danzell v3.3 rules	What catches small firms out
Cloud MFA	Gaps could sometimes be remediated without instant failure	Automatic fail if MFA is available (free or paid) and not enforced	Shared marketing, CRM, HR, or social media logins with MFA left optional
Cloud scoping	Grey areas around excluding secondary SaaS tools	Cloud services holding business data cannot be excluded from scope	Assuming “we only want to certify the office network” hides cloud apps
14-day patching (A6.4 & A6.5)	Up to two major patching non-compliances tolerated in some cases	Automatic fail if critical or high-risk fixes take longer than 14 days	Forgotten browser extensions, third-party PDF tools, and router firmware
CE Plus retesting	Self-assessment answers could sometimes be tweaked when testing started	Self-assessment is locked before Cyber Essentials Plus testing begins	Submitting an optimistic answer and hoping to fix it during the audit week
Board sign-off	Confirmed accuracy on the day of assessment	Commits the director to maintaining compliance for the full 12 months	Treating Cyber Essentials as a once-a-year tidy-up before letting standards slide

Fourteen days for patches is now a hard wall too

Cloud MFA gets the headlines, but questions A6.4 and A6.5 are the other trap in Danzell. Any critical or high-risk security update for an operating system, application, or firewall firmware must be installed within 14 days of release.

Previously, an organisation could pick up a couple of non-compliances here and still scrape a pass. Not anymore. And as I wrote yesterday about Windows 10 machines a year after end of support, an un-enrolled Windows 10 PC or a machine still sitting on Windows 11 24H2 or Office 2021 (both of which reached end of support on 13 October 2026) cannot receive those updates at all, which stops the assessment dead.

How I check this before you pay the assessor

My Windows and small-business security audit is built to find the things an assessor will fail you on before you hand over your certification fee and start the two-day remediation clock.

We do not guess which cloud apps the team uses. We read the browser histories, password managers, DNS logs, and Microsoft Entra or Google sign-in grants to build the actual list of cloud services holding your data. For each one, I check whether MFA is enforced at the account level rather than left as a polite suggestion in user settings, verify that every laptop and server is inside the 14-day patch window, and hand you a plain-English list of what to fix or shut down before you apply.

Common questions

What happens if we opened our Cyber Essentials account before 27 April 2026?
You had a six-month transitional window to submit under the older Willow (v3.2) question set. That window closes on 26 October 2026. Any assessment not completed by then, and every new renewal, is judged under Danzell (v3.3).

Do business social media accounts count as cloud services under Danzell?
Yes. LinkedIn, Facebook, X, and Instagram accounts used by the business fall under the cloud service definition and must have MFA switched on for every person who can access them.

What if a cloud tool we use does not offer MFA at all?
The automatic fail applies where a cloud service offers MFA (free or paid) and you have not enabled it. However, if a service storing company data has no MFA support whatsoever, you must enforce a stronger password rule (at least 12 characters, or 8 characters with an automatic deny-list blocking common passwords) and you should plan to replace it.

If your Cyber Essentials renewal is coming up and you would rather know what is going to fail before you submit the form, take a look at my Security Audits or send me a message with how many people and machines you have.