UK Cyber Essentials v3.3 ("Danzell") Practitioner Implementation Handbook

Section 1: What Changed in NCSC / IASME v3.3 ("Danzell" — 27 April 2026)

On 27 April 2026, the UK National Cyber Security Centre (NCSC) and IASME replaced v3.2 ("Willow") with the Cyber Essentials v3.3 ("Danzell") question set. Assessors are instructed to issue an immediate Automatic Certification Fail if any of the five core technical controls below are non-compliant across your in-scope estate.

Section 2: Cloud Service Scope & Home-Worker / BYOD VPN Rules (Sec A1.1 & A1.4)

Under v3.3 ("Danzell"), any cloud platform hosting organisational email, files, finance records, CRM data, or identity planes cannot be carved out of scope. Furthermore, home workers and BYOD devices operating on residential ISP routers do not have a trusted hardware boundary firewall.

2.1 Mandatory Boundary Controls for Remote & Home Workers

• Option A — MDM-Locked Host Software Firewall (Recommended for Cloud-Native SMEs): Enable Windows Defender Firewall or macOS Application Firewall across Domain, Private, and Public profiles via Microsoft Intune, blocking all unsolicited inbound connections and preventing standard users from disabling the firewall.
• Option B — Full-Tunnel (Split-Tunnel Disabled) Corporate VPN: Route 100% of remote endpoint traffic (`0.0.0.0/0`) through an Always-On VPN terminating at a managed corporate firewall that meets NCSC password/patching standards.

Section 3: Entra ID Zero-Exception MFA & Passwordless Throttling (Sec A4.5)

Deploy the four Conditional Access policies provided in templates/Entra-Conditional-Access-CEv33-Baselines.json:

3.1 Passwordless PIN & Biometric Brute-Force Throttling (Intune Windows Hello Baseline)

Intune Portal > Endpoint Security > Account Protection > Windows Hello for Business:
- Minimum PIN Length: 6 characters (8 recommended for Admins)
- Require TPM 2.0 Security Processor: Enabled (Blocks software-only fallback)
- Maximum PIN Failed Sign-In Attempts Before Lockout: 5 attempts (TPM anti-hammering active)
- Recovery / Backup Authentication: Require Entra MFA challenge or secondary FIDO2 key

Section 4: Intune 14-Day CVSS ≥ 7.0 Patching SLA & End-of-Life OS Removal (Sec A3.1)

IASME v3.3 requires all operating systems, browsers, firmware, and third-party applications to receive high/critical security updates (`CVSS v3 >= 7.0` or CISA Known Exploited Vulnerabilities) within 14 calendar days of vendor release.

4.1 Intune Windows Update for Business Ring Configuration

Section 5: 1-Day Leaver Offboarding & 30-Day Dormancy Governance (Sec A4.2)

Run this PowerShell remediation snippet immediately when HR notifies IT of a leaver (must execute within 1 working day) and monthly to suspend accounts inactive >30 days:

# 1. Immediate Same-Day Leaver Lockout & Token Revocation
$LeaverUPN = "former.employee@yourcompany.co.uk"
Update-MgUser -UserId $LeaverUPN -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $LeaverUPN

# 2. Automated Suspension of Internal/Guest Accounts Inactive > 30 Days
Import-Csv ./ce33-evidence/01-Entra-Identity-MFA-And-Dormancy.csv |
  Where-Object { $_.AccountEnabled -eq "True" -and [int]$_.DaysInactive -gt 30 } |
  ForEach-Object {
    Write-Host "Suspending dormant account (>30d): $($_.UserPrincipalName)" -ForegroundColor Yellow
    Update-MgUser -UserId $_.UserPrincipalName -AccountEnabled:$false
  }

Section 6: Final Pre-Submission IASME v3.3 Assessor Sign-Off Checklist

Complete every row below and attach the output of evaluate_ce_v33_posture.py to your internal compliance ticket before submitting your IASME portal declaration.