Cyber Essentials 2027: The Next Requirements Update Explained

Nothing about Cyber Essentials 2027 has been confirmed yet. As of 13 October 2026, IASME and the National Cyber Security Centre (NCSC) have not published new requirements, a new question set name or a start date for any 2027 update. Until they do, every new assessment and renewal uses the Danzell question set, based on version 3.3 of the NCSC’s Requirements for IT Infrastructure, which applies to assessment accounts created from 27 April 2026.

Sovereign Secure is an IASME-licensed Cyber Essentials certification body. This page records what is confirmed about the next update and how past updates were introduced, so you can plan your next assessment or renewal. We will add the 2027 changes here when IASME and the NCSC publish them, and not before. For what changed in April 2026, see our guide to Cyber Essentials changes 2026.

What changes in Cyber Essentials in 2027?

No changes have been announced. This is where things stand:

IASME describes an annual review of the requirements by the NCSC and IASME, but a review does not always produce a new question set. The five technical control areas (firewalls, secure configuration, security update management, user access control and malware protection) have stayed the same through every recent update. What has changed is the detail: definitions, scope rules and how strictly particular answers are marked.

When do the 2027 Cyber Essentials changes start?

No start date has been set. The 2026 update shows how a change is introduced, though not when the next one will come or what it will contain:

• Six months’ notice. IASME announced the April 2026 update on 3 November 2025, saying it was giving six months’ notice so that applicants had time to prepare.
• Full detail about ten weeks before go-live. IASME published the complete list of changes on 12 February 2026 and the Danzell question set on 13 February 2026.
• A cut-off date, not a switch-over day. The changes applied to assessment accounts created after 26 April 2026. Organisations with an account opened before then had six months to certify under the previous requirements.

So the date that decides which questions you answer is the date your assessment account is created, not your certificate’s expiry date or the date you submit. No equivalent announcement for 2027 had been published by 13 October 2026. When one is, expect it to follow the format of IASME’s February 2026 announcement: the go-live date, the account cut-off, the transition period and each change to the questions and marking.

How has the Cyber Essentials question set changed over time?

The Cyber Essentials 2027 question set has not been named yet. IASME gives each recent question set a name, and each one matches a version of the NCSC’s requirements document. The last four are below.

No new question set was introduced in 2024: Montpellier stayed in use for two years. That is why we describe updates as periodic rather than yearly, and why it is worth checking the official sources rather than assuming that a 2027 update will arrive on a particular date.

Will there be new automatic-fail questions in 2027?

None have been announced. Danzell made three areas automatic fails, however well you answer everything else, and they apply to every assessment opened now:

• MFA on cloud services: any cloud service that offers multi-factor authentication without it enforced for your users.
• Question A6.4: high-risk or critical updates for operating systems and router or firewall firmware not installed within 14 days of release.
• Question A6.5: high-risk or critical updates for applications, including extensions, not installed within 14 days of release.

If a 2027 update adds to this list, we will set out the new questions here when they are published. Our Danzell guide to the automatic-fail questions shows passing and failing answers for each, and our Cyber Essentials checklist explains how the 14-day rule is measured.

Do the 2027 changes affect my renewal?

Only if your renewal assessment starts after a new question set takes effect. A renewal is a fresh assessment, not a rollover, so you answer whichever question set is in force when your assessment account is created.

Don’t hold back a renewal while you wait for news. Certificates last 12 months and there is no grace period, so a late renewal leaves you uncertified until you pass. Start about four to six weeks before your expiry date, as our Cyber Essentials renewal guide explains.

How should you plan an assessment or renewal around the next update?

Prepare for the rules that apply today, and watch the dates. Each step below holds whatever the next update brings:

1. Meet Danzell in full now. Enforce MFA on every cloud service that offers it, install high-risk and critical updates within 14 days, and write a scope that names every legal entity.
2. Know which date matters. The question set is fixed when your assessment account is created, so plan when you will open it, not just when your certificate expires.
3. Diarise your expiry date. Put a reminder six weeks before it, and check this page at the same time.
4. Read the transition rules when an update is announced. If your renewal falls close to a 2027 cut-off, ask your certification body which question set your account will use before you open it.
5. Preview the right questions. Use our Cyber Essentials questionnaire page to draft your answers offline, and check that the version you use matches the question set your account will use.
6. If you hold Cyber Essentials Plus, patch your whole estate, not just the devices you expect to be sampled. Since April 2026, a failed update test is retested on the original sample plus a fresh random one.

How will you know when the Cyber Essentials 2027 requirements are published?

From the official sources. The NCSC publishes each version of the requirements document on its Cyber Essentials resources page, and IASME announces question set changes in its articles and publishes the new questions as a free download. Your certification body can also confirm which question set an assessment you have opened will use.

When the 2027 requirements are published, we will update this page with the question set name, the dates, what changed and any new automatic-fail questions. Until then, be wary of any “2027 requirements” that do not cite IASME or the NCSC.

Why Sovereign Secure

• IASME-licensed certification body. We assess and certify both Cyber Essentials and Cyber Essentials Plus against the current question set, and we track each update as it is announced.
• Published prices. Cyber Essentials costs from £320 + VAT (Bronze, 0 to 9 employees) to £750 + VAT (Gold, 250+ employees). Every package includes a pre-assessment check and a support call of up to an hour, which is where we catch cloud MFA gaps and overdue updates before they become automatic fails.
• Wider assurance. Sovereign Secure Ltd was incorporated in 2012 (Companies House 08334453), is ISO 27001 certified and is a PCI SSC Qualified Security Assessor (QSA) company.

Next step

If your certificate is due in the next few months, renew now under Danzell rather than waiting for news of Cyber Essentials changes in 2027. Run our free Cyber Essentials readiness check to see how you would do against the current rules, then choose one of our Cyber Essentials certification packages, from £320 + VAT. Or send us your expiry date through the form below and choose “Cyber Essentials renewal (CE)”, and we will tell you which question set your renewal will use. You can also call +44 161 523 5276.