UK Cyber Essentials v3.3 ("Danzell") & EU NIS2 Article 21: A Practical Technical Checklist for IT Managers & MSPs

Whether your organisation is renewing UK Cyber Essentials / Cyber Essentials Plus v3.3 (the "Danzell" specification) or answering EU NIS2 Article 21 / DORA supply-chain security questionnaires from enterprise customers, assessors keep failing domains on the same avoidable technical controls.

At FaultyPacket Security Lab, we built offline evidence scripts and live browser scanners to catch these gaps before your assessor or enterprise client does. Here is the exact technical checklist we run.

1. Passwordless, FIDO2 & Entra ID Conditional Access (Cyber Essentials v3.3)

Under the NCSC Cyber Essentials v3.3 ("Danzell") question set, three areas trip up Microsoft 365 / Entra ID and Google Workspace tenants:

1. Explicit Administrative Account Separation: Daily driver accounts (the ones receiving email and browsing the web) must not hold Global Admin, Privileged Role Admin, or Exchange Admin privileges.
2. MFA Coverage Across Every Cloud Service: Every user and admin account accessing cloud services must enforce MFA—or use brute-force throttling + minimum 12-character passwords (or 8+ characters backed by automatic deny-list screening).
3. Device Run-Time & Patch Cadence: Operating systems, browsers, and edge firewalls must remain vendor-supported and have high/critical CVEs (CVSS v3 >= 7.0) patched within 14 days of release.

2. External Mail & Perimeter Hygiene (NIS2 Article 21 & DORA)

Enterprise procurement teams running NIS2 Article 21(2)(d) supply-chain risk assessments scan your external apex domain before they ever send you a questionnaire. They check five DNS and TLS indicators automatically:

• DMARC Enforcement (v=DMARC1; p=quarantine or p=reject): A policy of p=none offers zero spoofing protection and is flagged as an unmitigated phishing risk on vendor scorecards.
• SPF Recursive Lookup Ceiling (<= 10 DNS mechanisms): Exceeding 10 recursive lookups triggers SPF PermError under RFC 7208 §4.6.4.
• Inbound Transport Encryption (MTA-STS mode enforce + TLS-RPT): Prevents STARTTLS stripping on inbound mail.
• Web Security Headers & /.well-known/security.txt (RFC 9116): Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, and a valid security.txt disclosure endpoint.
• Zero Exposed Legacy CGI / PHP Runtimes: Screening for CVE-2024-4577 (PHP-CGI argument injection), exposed phpinfo(), and unhardened disable_functions.

3. Free Scanners, Offline Evidence Scripts & 24h Async Audits

You don't need an £800/day consultant or a £600/year recurring SaaS contract to verify these controls:

• Run a Free Live Domain & Email Auth Scan — Instant browser-side check for DMARC, SPF recursive lookups, DKIM, and MTA-STS.
• Download Self-Contained Compliance & Remediation ZIP Packs:
  • Cyber Essentials v3.3 "Danzell" & Entra ID Evidence Pack (£29 one-off)
  • NIS2 & DORA Bulk Supplier Domain Auditor (£19 one-off)
  • DMARC, SPF, MTA-STS & PHP2Shell Hardening Pack (£24 one-off)
• Prefer a 100% Async Done-For-You Audit (Zero Calls Required)? Order directly via FaultyPacket Async Audit Services or on Fiverr (@faultypacket).