CE Willow
Cyber Essentials Willow
93 questions across 8 sections.
93
Total questions
8
Sections
7
New vs Montpellier
3
Removed vs Montpellier
What changed from Montpellier:
7 new questions added, 3 removed.
Use the CE Explorer to see exactly what changed and where.
A1
Your Company
Organisational identity and context. Determines how the question set is tailored and what appears on the certificate.
A2
Scope of Assessment
Defines what is covered by the certification. Determines which devices, networks, and cloud services are in scope.
A3
Insurance
Eligibility and opt-in for automatic cyber insurance. Revenue question removed in this version — only email contact req…
A4
Firewalls
Technical protection between network devices and the internet. Significantly restructured from Montpellier — software f…
A5
Secure Configuration
Ensuring devices and services are configured securely. Largely consistent with Montpellier; passwordless option added t…
A6
Security Update Management
Keeping software up to date. Willow adds CVSSv3 scoring as an explicit threshold trigger, extends scope to 'vulnerabili…
A7
User Access Control
Limiting user access to what is necessary. Willow broadens A7.2 to 'unique credentials' (covers passwordless); A7.10 ex…
A8
Malware Protection
Protecting devices from malware. Consistent with Montpellier; minor wording updates and CE Requirement references added.
How does your organisation measure up against Willow?
Check your real-world posture against these requirements in 3 minutes. Free, no account needed.