Willow to Danzell: What to Do If You Have an Open Cyber Essentials Account
Willow to Danzell: What to Do If You Have an Open Cyber Essentials Account
IASME retires the Willow question set on 27 April 2026. If you've already started a Cyber Essentials assessment under Willow and haven't finished it, there are hard deadlines for completing it. Miss them and you lose your work, your fee, and your progress. There is no extension process and no way to recover a deleted account.
This article covers the exact dates, what happens at each cutoff, and what to do right now if you have an open Willow account on Pervade.
The deadlines
| Date | What happens |
|---|---|
| 26 April 2026 | Last day to create a new Willow assessment account |
| 27 April 2026 | Danzell mandatory for all new assessments |
| 26 October 2026 | Last day to complete a CE assessment under Willow |
| 27 October 2026 | Open Willow CE accounts deleted from Pervade |
| 26 January 2027 | Last day to complete a CE Plus assessment under Willow (including 30-day remediation) |
Two things to note here. The 26 October date is the last day your CE certification can be generated under Willow, and a certification generated on 27 October or later under the Willow question set is not valid. The same applies to CE Plus after 26 January 2027.
The CE Plus deadline includes the 30-day remediation window. If your assessor finds issues during the technical audit and you need the full remediation period, you need to have started early enough that the remediation completes before 26 January 2027. The deadline does not move because you started your remediation late.
What happens if you miss the Willow CE deadline?
On 27 October 2026, IASME will delete open Willow CE accounts from Pervade, and that means three things for you.
Your answers are gone. Every question you've filled in, every document you've uploaded, and every note your assessor has added to your account will be deleted. Pervade will not keep a copy and neither will your certification body. If you didn't export your answers before the deadline, they do not exist any more.
Your fee is gone. You paid for a Willow assessment, and that payment covered an assessment under the Willow question set. It does not transfer to Danzell. If you want to certify after the deadline, you'll need to create a new Danzell account through your certification body and pay the full fee again.
Your certification is not valid. Even if you somehow managed to generate a Willow CE certificate after 26 October 2026, it would not be recognised. IASME won't list it on the certified organisations register, and your customers and supply chain partners who check the register won't find you. The certificate would be worth nothing.
If you don't complete your Willow account by the deadline, you lose all your work and have to pay again. There is no extension and no exceptions, so export your answers before 27 October.
What happens if you miss the Willow CE Plus deadline?
The same outcome applies, shifted to 26 January 2027. CE Plus gets longer because the assessment involves a technical audit by your assessor and can include a 30-day remediation period if vulnerabilities are found.
The 26 January deadline is the date by which your CE Plus certification must be fully generated, not just started and not still in remediation. If your assessor finds issues on 20 January and gives you 30 days to fix them, you have already missed the deadline. The remediation would run past 26 January and your Willow CE Plus certification would be invalid.
Work backwards from 26 January 2027. Allow 30 days for potential remediation, a week for your assessor to schedule and run the technical audit, and whatever time you need to finish filling in the question set. For most organisations, that means having the CE Plus question set fully submitted to your assessor by late November 2026 at the latest.
What to do right now if you have an open Willow CE account
You have a Willow CE account on Pervade that is not finished. Here's what to do, in order.
Export your current answers
Log into Pervade and export everything you've entered so far. Download a copy of your answers, any supporting documents you've uploaded, and any notes. Do this today, not the day before the deadline. If anything goes wrong with your account between now and October, you'll at least have a record of what you wrote.
The export matters even if you plan to finish under Willow, because if you don't finish in time, you'll need those answers as a reference when you repopulate a Danzell account. The Danzell questions are different, but many of them cover the same ground. Having your Willow answers means you won't be starting from a blank page.
Work out whether you can finish under Willow
Be honest about how far along you are. If you're 80% through the question set and your assessor is responsive, you can probably finish before 26 October. If you're 20% through and you haven't spoken to your assessor in three months, the realistic path might be to let the Willow account go and start fresh on Danzell.
The worst outcome is spending the next six months trying to finish under Willow, missing the deadline by a week, and then having to start over on Danzell anyway. If you're not confident you'll make it, switching to Danzell now saves you the risk. You'll pay for a new account, but you'll have six months to complete it instead of racing a hard cutoff.
Talk to your certification body
Your certification body (the organisation you purchased the assessment from) can tell you where your account stands and what's left to complete. They can also tell you whether switching to Danzell now makes more sense than trying to finish under Willow. (consistent with the 2025 telemetry evaluation criteria).
If you're a Net Sec Group client with an open Willow account, get in touch. We'll review your account, tell you honestly whether the Willow deadline is achievable, and help you decide which route to take.
If you switch to Danzell, know what changed
The Danzell question set aligns with version 3.3 of the Cyber Essentials Requirements for IT Infrastructure. The five technical controls have not changed. Firewalls, secure configuration, user access control, malware protection, and security update management are the same as they were under Willow.
What changed is scope, definitions, and enforcement. Cloud services can't be excluded from scope any more, and the definition of what counts as a cloud service is now formal. Passwordless authentication (including FIDO2 and passkeys) is explicitly recognised, and scope criteria are broader because Danzell removed the qualifiers "untrusted" and "user-initiated" from the connection rules.
The full breakdown is in the Danzell changes guide. The side-by-side comparison of Willow and Danzell is in the comparison article. If you want a checklist to work through before your Danzell assessment, use the readiness checklist.
Don't try to learn every Danzell change before you start. Most of the changes are definitional, and the question set itself will walk you through what's needed. Focus on the scope change (list all your cloud services, because they're all in scope now) and make sure your MFA is turned on everywhere.
What about CE Plus under Willow?
If you have an open Willow CE Plus account, you have until 26 January 2027, which sounds like more time, but CE Plus has more moving parts.
The CE Plus process requires your assessor to run an external vulnerability scan, an internal vulnerability scan on a sample of your devices, and a configuration review. If the internal scan finds unpatched critical or high-risk vulnerabilities (CVSS 7.0 or above) older than 14 days, you'll enter the remediation window. Under Danzell, a second sample gets triggered too, but under Willow the process is a single sample with a 30-day remediation period.
The key calculation is the same as CE: work backwards from 26 January 2027. Allow 30 days for remediation, two weeks for your assessor to schedule and run the scans, and enough time for you to fix anything that comes up in the question set. If you are not ready for the technical audit by late November 2026, you're cutting it close.
The deadline is not a soft cutoff, and certifications issued after 26 October 2026 for CE, or after 26 January 2027 for CE Plus, under Willow are not valid.
Can you create a new Willow account after 26 April 2026?
No. After 26 April 2026, all new assessment accounts go through the Danzell question set, and if you have not created a Willow account by that date, you cannot create one. The only organisations that will have Willow accounts after April are those who created them before the cutoff and are working through the grace period.
If you're thinking about starting a Cyber Essentials assessment and you haven't begun, there is no advantage to rushing to create a Willow account before 26 April. Willow accounts created at the last minute still need to be completed by 26 October (CE) or 26 January 2027 (CE Plus), and starting fresh on Danzell gives you the current question set with no deadline pressure from a platform transition.
What if you're mid-renewal?
If your current Cyber Essentials certificate expires between now and October 2026, and you haven't started your renewal yet, you'll need to decide between starting a Willow account now (before 26 April) or waiting and going straight to Danzell (after 27 April).
If your certificate expires before 27 April, you'll renew under Willow because that is the only option available at the time of your renewal. Complete it before 26 October and you're fine.
If your certificate expires after 27 April, your renewal will be under Danzell by default, because all new accounts after that date are Danzell. The transition is automatic and you do not need to do anything special.
The gap to watch is if your certificate expires in May or June 2026. You could start a Willow account before 26 April and try to complete it quickly, or wait until 27 April and start on Danzell. For most organisations, starting on Danzell is simpler. The technical controls are the same, the question set will guide you through the new scope rules, and you won't be racing a platform deadline on top of your certification deadline.
The one thing you must do today
If you have an open Willow account on Pervade, export your answers. Everything else in this article can wait a week, but the export cannot, because every day you don't have a backup is a day your work is at risk. Pervade accounts can have access issues, your certification body might have a system migration, or you might simply forget as October approaches.
Export your answers today. Then decide whether to finish under Willow or switch to Danzell. If you're not sure, talk to your certification body or check the Danzell readiness checklist to see how much would change if you switched. For pricing on a new assessment, see the CE options and CE Plus options. If you want continuous scanning, patching, and certification handled for you going forward, see CE+ Assured.
Related articles
- Cyber Essentials v3.3: What the Danzell Update Changes
- Danzell vs Willow: What Actually Changed
- Danzell Readiness Checklist
Get cybersecurity insights delivered
Join our newsletter for practical security guidance, Cyber Essentials updates, and threat alerts. No spam, just actionable advice for UK businesses.
Related Guides
Can Your CE Basic Certificate Be Revoked? What Happens When You Fail CE Plus Under Danzell
Under Danzell, failing the CE Plus second sample scan can revoke your CE Basic certificate too. Here is how revocation works, what it costs, and how to prevent it.
Cyber Essentials Plus First-Time Pass: What Danzell Actually Requires
Under Danzell, CE Plus scans must pass first time. No remediation during the assessment. Here is the double sampling process, what triggers it, and how to prepare.
Why RMM Scanners and Windows Defender Will Fail Your Cyber Essentials Plus Assessment
RMM tools and Windows Defender are not approved for CE Plus internal vulnerability scans. Here is what the assessment actually requires and why your IT provider's scanner will miss critical vulnerabilities.
Ready to get certified?
Book your Cyber Essentials certification or check your readiness with a free quiz.