Cyber Essentials Willow Update 2025

What You Need to Know

The latest Cyber Essentials update, ‘Willow’, was released in May 2025, marking a significant evolution in the UK government’s flagship cyber security certification scheme. Replacing the ‘Montpellier’ question set, Willow reflects updated guidance from the National Cyber Security Centre (NCSC) and responds to emerging threats that businesses face today.

Whether you’re renewing your certification or applying for the first time, here’s a clear breakdown of what’s changed — and what your business needs to do next.

Key Changes in the 2025 Willow Update

The Willow update builds on the previous Montpellier release, revising definitions, terminology, and processes to keep Cyber Essentials aligned with current cyber security best practice.

Some of the headline changes include:

1. Expanded Scope: Firmware is Now In-Scope

The term ‘software’ now explicitly includes firmware, such as that found on firewalls and routers. This means organisations must ensure these critical systems are updated regularly — and are no longer exempt from compliance checks.

Why it matters: Unpatched firmware is increasingly targeted by attackers and often overlooked in patch management strategies.

2. Mandatory Asset Management Practices

Organisations must now maintain an accurate, up-to-date inventory of all devices and software within scope. This includes:

Company-issued and personal (BYOD) devices
Cloud services
Networking equipment
Installed applications

Why it matters: Asset visibility is a fundamental control for identifying vulnerabilities and reducing risk.

3. Tighter Controls for BYOD (Bring Your Own Device)

“Plugins” have been replaced with “frameworks and extensions,” a change that aligns terminology with modern software development and deployment.

4. Cloud Services: MFA Now Mandatory

The update introduces stricter rules for personal devices used for work, referencing the latest NCSC guidance. Organisations must:

Define clear BYOD policies
Enforce controls like device encryption and screen locks
Ensure staff understand their responsibilities

Why it matters: Personal devices are often a weak link, especially in remote or hybrid environments.

What Your Business Needs to Do

Whether you’re looking to achieve certification for the first time or renew under Willow, you’ll need to ensure that your policies, tools, and documentation reflect these new expectations.

Here’s how to stay compliant:

✅ Review the full Willow requirements on the NCSC website.

✅ Audit and update your asset management processes.

✅ Apply firmware patching to all in-scope devices.

✅ Enforce MFA across all cloud platforms, for all users.

✅ Review and formalise your BYOD policies and training.

Need Help Navigating the Willow Update?

As an IASME-approved certification body, CyberLab has already helped hundreds of organisations achieve Cyber Essentials and Cyber Essentials Plus — and we’re ready to guide you through the Willow update too.

Whether it’s a full audit or a quick compliance health check, we can support you every step of the way.

Refresh: Cyber Essentials vs Cyber Essentials Plus

Not sure which level of Cyber Essentials is right for your organisation? Here’s a quick comparison of the two certification options to help you decide:

Feature	Cyber Essentials	Cyber Essentials Plus
Assessment Method	Self-assessment questionnaire reviewed by a certifying body	Independent audit including external testing of systems and devices
Technical Scope	Five core controls: firewalls, secure configuration, user access control, malware protection, and patch management	Same five controls, but verified through hands-on technical testing
Level of Assurance	Basic assurance based on self-declared compliance	Higher assurance through in-depth technical verification
Cost	£300–£600 + VAT, depending on organization size	£1,365+, depending on organisation size
Time & Resources	Typically completed within a few days to weeks, depending on readiness	More involved process; includes on-site or remote audits and potential remediation period
Certification Validity	12 months	12 months
Ideal For	Small businesses seeking a cost-effective way to demonstrate basic cyber hygiene	Organizations handling sensitive data or requiring higher security assurance
Badge Usage	Use of Cyber Essentials badge to showcase compliance	Use of Cyber Essentials Plus badge, indicating higher security standards