Cyber Essentials Willow update: Cyber Essentials changes
The Cyber Essentials Standard is continually improved and updated through collaboration and consultation between IASME, the official certifying body, the NCSC, and assessors and businesses. These changes keep the standard up to date with changes in technology, our way of working, and new cyber threats. In this blog, I will highlight what has changed in 2025 and tell you everything you need to know about the Cyber Essentials Willow update.
As of 28th April 2025, Cyber Essentials is changing again. Organisations that previously submitted the self-assessment questionnaire called “Montpellier” will now move to Willow.
Willow introduces clearer guidance for hybrid working, broadens the definition of vulnerability management beyond patching, and supports passwordless authentication. Cyber Essentials Plus will see stricter audit checks and faster remediation expectations, making the scheme more aligned with current security practices.
Firstly, what is the Cyber Essentials Scheme?
The Cyber Essentials is a UK government-backed security standard, designed to help businesses protect themselves against common cyber threats. It sets out a baseline level of security in place across 5 key control areas:
- Firewalls
- Secure Configuration
- Security Update Management
- User Access Control
- Malware Protection
Organisations define the scope (what devices, networks and cloud applications are covered), apply the technical controls mandated by the standard, and then attest to the successful implementation and operation of those controls.
To further enhance the level of reassurance, organisations can undergo an independent audit of these controls across a sample of the in-scope assets, networks, and cloud applications, called Cyber Essentials Plus.
The five technical control areas will continue to be part of the current CE assessment, but here we will walk through what changes you will see in the new question set Willow in 2025.
Passwordless authentication now accepted in Cyber Essentials Willow
Passwords have long been the default method for authentication. However, due to well-known security issues ranging from forgotten passwords to the reuse of weak passwords across multiple accounts, passwordless authentication is now a stable feature offered by many major developers and manufacturers. This approach helps mitigate known vulnerabilities in traditional systems by offering multiple alternative authentication methods
The password requirements currently outlined are the following:
- A minimum password length of at least 12 characters, with no maximum length restrictions
- Using multi-factor authentication
- A minimum password length of at least 8 characters and the blocking of common passwords.
Passwordless authentication is now accepted as a form of authentication. This is a method of using the users of either of the following in place of a password when logging into a device.
- Biometrics – User traits such as facial features or fingerprints
- Security Keys and Tokens – USB security keys or smart cards
- One-Time Codes – Temporary codes sent via email, SMS, or mobile apps
- Push Notifications – Using a smartphone app to approve or deny login attempts
Out with “Patches and Updates”, in with “Vulnerability Fixes”
Previously, the guidance referred to “patches and updates” to fix vulnerabilities. It now uses the term “vulnerability fix” to ensure the scope of remediation also includes registry edits, configuration changes, or vendor-provided scripts.
This change in terminology has been made to ensure all applicants understand that configuration and registry changes are now included within the scope of the requirement, and require remediation – something that was not clearly stated under the previous definition.
Remote worker definition changed
The reference to “home working” has been revised to include users working from any location outside the corporate network. This now covers all types of remote environments, such as shared office spaces, cafés, or hotels. This shift in terminology highlights the importance of securing staff and assets across all types of modern working setups.
This change will not include any additional questions or tests, but is intended to ensure that the applicants’ answer of how many staff are remote workers is broader than previously required.
How to be prepared for Cyber Essentials Willow
Whether you are already certified or looking to certify for the first time, we recommend reading the latest self-assessment questionnaire, and the latest Cyber Essentials technical requirements published by the NCSC.
- Review your remote and hybrid work environments and make sure they are secure.
- Make sure your vulnerability management process covers more than just patching.
- Explore how passwordless authentication could benefit your business.
- Ensure Multi-Factor Authentication (MFA) is applied to all your cloud services for all users.
These changes should be considered if you are taking the CE assessment and planning to progress to the CE+ assessment.
Validate your internal boundaries
Defining the scope during the CE assessment can be challenging, especially when determining which networks to include or exclude. Establishing scope accurately at this stage is critical because any exclusions declared during the CE assessment will be subject to validation in the CE+ assessment. This ensures that proper boundaries are in place and align with the defined scope.
Extended Security Update Schemes
For operating systems no longer supported under mainstream vendor support but still receiving Extended Security Updates (ESUs), confirmation of these updates has always been required during CE assessments. For CE+ Willow assessments, you must now provide evidence that ESUs are in place. This includes receipts of payment or licensing confirmations for each device receiving extended updates.
Need help with Cyber Essentials?
Evalian can assist with getting to navigate the new changes. If you a renewing your certification or this is your first time, we can offer expert guidance and support to achieve CE.
What we offer:
- Our CE Readiness Workshop to home in on your control gaps.
- Technical support and expert advice tailored to Cyber Essentials
- Dedicated consultant support throughout your submission process
Contact Evalian to speak with our team of experienced security consultants who have successfully helped hundreds of businesses become CE certified.
