Understanding the new Willow question set for Cyber Essentials certification

The Willow question set has been live for all Cyber Essentials certifications since 28 April 2025, replacing 2023’s Montpellier criteria. It is more evolution than revolution: clearer scope, firewall documentation, updated password guidance, “vulnerability fixes” in place of patch management, and all cloud services in scope. Cyber Essentials Plus audits also changed.

If your organisation is working towards certification, here is what changed and why it matters.

Why the changes are happening

Cyber threats keep evolving, and the framework has to keep pace. Willow was developed by IASME and the National Cyber Security Centre (NCSC) to reflect today’s working environments and technologies. The updates aim to make assessment clearer, more aligned with modern practice, and more effective at strengthening cyber resilience.

Key changes in the Willow question set

Scope clarity

Organisations now get clearer direction on what must be in scope. Devices accessing organisational data or services, whether through internal networks or cloud platforms, must be included.

Firewall requirements

All firewalls and routers must be documented in the network equipment section. Remote and home-working routers must use software firewalls, and the guidance encourages more regular reviews of firewall configurations.

Password policies and authentication

The guidance on passwords has been refreshed to reflect best practice. Passwordless authentication is now recognised as a valid method for protecting firewalls and routers. Where passwordless systems fall back on passwords, brute-force protections (for example complex, randomised passwords) are still required.

Patch management becomes vulnerability fixes

The terminology has shifted to emphasise timely updates. Any vulnerability rated CVSS 7.0 or above, or considered high or critical risk, must be addressed, whether through patching, registry changes or configuration changes.

All cloud services are in scope

All cloud services an organisation uses, including Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS), are now explicitly included. This covers every platform that handles organisational data.

Updated language

Minor wording changes improve clarity. For example, “extensions” is used instead of “plugins”, and “home and remote working” instead of just “home working”.

How Cyber Essentials Plus is changing

The core question set affects both levels of certification. Cyber Essentials Plus also has process changes, particularly in Tests 2 and 4.

Test 2: internal vulnerability assessment

• Device sampling must now happen immediately before the audit, rather than using data from the self-assessment.
• Auditors review and store evidence of the sampling methodology.
• The assessment is based on a random sample of devices chosen by the assessor and shared no more than 3 working days before the test.
• High-risk configuration issues, such as unquoted file paths or registry key misconfigurations, now count as assessment failures.

Test 4: multi-factor authentication for cloud services

• Not all cloud services are tested, only those accessible by devices or users in the scope.
• If a cloud service is not accessible to anyone in the sample, it is not tested.

What this means for your organisation

These changes should make the requirements easier to understand and compliance smoother. Clearer language and alignment with current technology can help you reduce risk and streamline certification. If your Cyber Essentials renewal is coming up, familiarise yourself with the Willow updates early so you are not caught out.

Certification also matters for insurance. Lanmark holds Cyber Essentials, and IASME provides the insurance that comes with certification. A guaranteed pass depends on you remediating everything the assessment finds, so fixing gaps early is the best preparation. Insurers often ask related questions, covered in our guide to cyber insurance IT requirements.

How Lanmark can help

Navigating Cyber Essentials can be challenging. Lanmark can help organisations prepare for Cyber Essentials and Cyber Essentials Plus certification. Our consultants can:

• Provide guidance on the requirements, including the changes introduced in the Willow question set.
• Assess your current cyber security posture.
• Identify gaps and recommend remediation.
• Assist with implementing the necessary controls and processes.
• Prepare your organisation for the assessment.

See our cyber security services or contact us to talk through your renewal.