Cyber Essentials used to be a form-filling exercise. The Danzell question set, mandatory for accounts created from 26 April 2026, turned missing MFA on any cloud service into an automatic fail, added two new auto-fail patching questions, and pulled every AI and LLM tool into scope as a cloud service. If you deployed an agent since your last renewal, you have a certification problem you did not have last year.
Why teams choose us.
Assessed Against Danzell
Not the Willow set, not a generic checklist. The current question set, with the auto-fail conditions called out first because they are the ones that sink applications.
AI Tools Inventoried
Every LLM tool, agent and AI service your teams use, mapped as an in-scope cloud service with an owner and an access position. Most organisations have no such list.
Whole-Organisation Scope
Danzell pushes harder for whole-organisation scope. We identify what a narrow scope would exclude and what that costs you commercially before you commit to it.
We Are Not The Assessor
Certificates come only from an IASME-licensed certification body. We prepare you, then introduce you to one — and take no fee from them.
The full menu.
The Five Control Themes
- Firewalls and internet gateways
- Secure configuration
- Security update management
- User access control
- Malware protection
The Auto-Fail Sweep
- MFA on every cloud service, without exception
- Critical and high patches inside 14 days
- Unsupported software identified and removed from scope
- Default credentials and unnecessary accounts closed
AI & Cloud Inventory
- LLM and agent tools as in-scope cloud services
- Shadow AI discovery across teams
- Access model and MFA position per tool
- Sanctioned-tool policy your director can sign against
Device & Endpoint Baseline
- MDM enrolment across the scoped estate
- BYOD position and enforcement
- Disk encryption and screen-lock policy
- Malware protection coverage evidence
Certification Handover
- Introduction to an IASME-licensed certification body
- Scope statement drafted for the assessor
- Evidence pack in the format they ask for
- Support during the assessment questions
Our process.
Scope & Inventory
Agree the organisational boundary, then inventory devices, cloud services and — critically — every AI tool in use. The inventory is usually where the surprises are.
Auto-Fail Sweep
We check the conditions that fail an application outright before anything else, so you learn the bad news in week one rather than at assessment.
Remediate
MFA rollout, patch pipeline, MDM enrolment, configuration hardening. Delivered as engineering work, with your approver merging every change.
Hand Over
Evidence pack, scope statement, and an introduction to a licensed certification body. They assess; we support you through their questions.
What we build with.
Choose this if...
Honest about who this is for.
This will be a fit.
- You are a UK private-sector organisation with a real certification deadline
- You would rather find the auto-fails in week one than at assessment
- You want the remediation done, not just a gap list
- You accept that the certificate comes from a licensed body, not from us
Honestly — not our zone.
- —You want us to issue the certificate — we are not an IASME-licensed certification body and cannot
- —You need Cyber Essentials Plus hands-on device testing in the UK. That is an on-site assessment by a licensed body; we prepare you for it and refer it
- —You are a UK public-sector body. G-Cloud 15 requires CE Plus of cloud suppliers and public work requires UK data residency and cleared staff — we decline it
- —You want the narrowest possible scope to pass. Danzell pushes toward whole-organisation scope and we will tell you what a narrow scope costs you