Willow to Danzell Migration Guide: What UK Firms Need to Do Between Cyber Essentials Platform Versions

‍​‌‌‌‌‌‌‌​‌‌‌​​​​​​‌​​‌‌‌‌​​‌​​​‌‌‌‌​​‌‌‌‌​‌​‌​‌‌​​‌‌‌​‌​‌​‌‌​‌​​‍The Cyber Essentials scheme moved from the Willow version onto the Danzell platform in April 2026. The platform name change is administrative; the substantive change is what Danzell now expects in evidence terms: year-round vulnerability scanning and patching across the certificate period, not the renewal-week sprint that Willow's strict reading allowed.

This article walks through what changed, what firms holding Willow-era certificates need to do for the next renewal, and how the Cyber 365 programme bridges the gap operationally.

What Willow allowed and what Danzell now expects

Under the Willow version of the scheme, the requirements text on patching was:

• High-severity (CVSS 7.0+) and critical vulnerabilities patched within 14 days of vendor release
• An assessor-led vulnerability scan on assessment day for CE Plus
• Confirmation via the questionnaire that the patching cadence held

The strict reading: as long as the assessor's scan on assessment day showed the high-severity vulnerabilities were patched within 14 days of vendor release, the patch-management control was satisfied. The scheme did not require the firm to demonstrate the cadence held across the whole 12 months.

Danzell makes the year-round expectation explicit. The platform now expects continuous evidence that the patching cadence held throughout the certificate period:

• Continuous vulnerability scanning against the in-scope IT estate
• High-severity findings closed within the 14-day window throughout the year, not just at renewal
• Logging and reporting that documents the cadence over time
• The CE Plus assessor's day-of sample is now supplementary to the year-round evidence, not the primary check

The five Cyber Essentials controls remain the same. The patching control is enforced harder. (as noted in the March 2024 exposure review).

What this means for current certificate holders

Existing certificates issued under Willow remain valid until their normal 12-month expiry. There is no requirement to re-issue under Danzell.

The next renewal will be assessed under Danzell. Firms should expect the renewal to require evidence of year-round scanning and patching across the certificate period, not just the renewal-week sprint.

Two firm patterns:

The first pattern is firms that already ran year-round operational discipline as standard (often via an MSP that handles patching as part of the managed-IT service, plus a continuous scanning service). For these firms, the Willow-to-Danzell transition is administratively new but operationally a non-event.

The second pattern is firms that ran the renewal-week sprint and now need to formalise year-round discipline. These firms typically engage a year-round vulnerability scanning + managed patching service that produces the evidence Danzell expects, in time for the next renewal.

The migration steps for firms in the second pattern

The migration is operationally simple but requires lead time. Working backwards from the next renewal date:

12 months before renewal: identify the year-round scanning and patching arrangement. Either the firm's existing MSP extends scope to cover continuous scanning and the 14-day patching window, or a separate service runs alongside the MSP. The Cyber 365 programme is the right answer for most firms in this position.

9 months before renewal: confirm the operational discipline is producing the right logs and reports. The first quarterly review of the scan and patching logs validates the workflow.

6 months before renewal: confirm the patching cadence is holding across the in-scope estate. Any structural gaps surface at this point and can still be addressed before assessment.

3 months before renewal: book the renewal assessment. The evidence package is largely complete by this point, drawn from the year of operational logs.

Renewal week: the assessment proceeds as a check-in against an estate that has been kept in shape, not a recovery operation against a year of drift.

For firms whose renewal is sooner than 12 months away, the lead time is compressed. The Cyber 365 programme can start within a working week of the scoping call; the longer the runway before renewal, the more confident the assessment proceeds.

How CE Plus and Cyber 365 fit together for the migration

A Cyber Essentials Plus certificate is valid for 12 months. The Danzell-era expectation is continuous posture across those 12 months. The two timeframes do not line up unless something runs continuously.

Cyber 365 is what runs continuously. The programme covers:

• Continuous vulnerability scanning across the in-scope IT estate
• Managed patching with the 14-day window enforced
• Logging and reporting that documents the cadence over time
• Co-ordination with the firm's existing MSP to avoid double-patching
• Renewal-time package preparation so the next CE Plus assessment proceeds smoothly

For firms with a Willow-era certificate approaching renewal, Cyber 365 starting now produces the evidence Danzell expects by the time the renewal lands.

The CE+ Assured Programme bundles CE Basic, CE Plus, and Cyber 365 into one monthly subscription. For firms wanting the certificate and the year-round discipline as one rolling engagement, this is the wrapped version.

Where to start

Book a 30-minute scoping call. We need the firm's device count, the current CE Plus certificate status (issued under Willow, expiry date), the current scanning and patching arrangement, and any procurement or contract deadline. We come back with a written quote covering the Cyber 365 programme and, where it makes sense, the bundled CE+ Assured Programme alongside it.

The IASME £25,000 cyber insurance comes free with every Cyber Essentials certificate for qualifying UK SMEs under £20 million turnover. It is between the certified firm and IASME. NetSec does not bundle, broker, or upsell it.

The Willow-to-Danzell migration is not a bureaucratic exercise. It is the scheme catching up to what the threat landscape requires of any organisation that holds a current Cyber Essentials certificate. Year-round scanning and patching has always been the right answer; Danzell makes it the explicit answer. The cleanest response is to operationalise the year-round discipline now, regardless of when the next renewal lands.

netsec-canary-f9a08890cbd6.