In short: Cloud services in Cyber Essentials are on-demand, scalable services on shared infrastructure, reached over the internet through an account, that store or process your organisation's data. Under Requirements v3.3 they can never be excluded from scope, you stay responsible for every control, and user access control, including MFA, is always your job.
What counts as a cloud service
Version 3.3 of the NCSC requirements added a formal definition for the first time. In our words: a cloud service is an on-demand, scalable service hosted on shared infrastructure and reached over the internet, which your organisation accesses through an account and which stores or processes your data.
Two details in that definition widen the net:
- The account can be an email address. It does not have to be an identity your IT team issued. A file-sharing, survey or design tool someone signed up to with their work email is a cloud service in scope.
- It is about your data. If the service holds or processes organisational data, it counts, whether it is a large platform or a niche app used by one team.
Examples range from Microsoft 365, Google Workspace and Dropbox to accounting, payroll, CRM and HR platforms, through to virtual servers in Amazon Web Services or Microsoft Azure.
Why cloud services cannot be excluded
Earlier versions already said cloud services hosting your data had to be in scope. Version 3.3 removes any doubt: cloud services cannot be excluded. You might carve an isolated on-premises system out of scope with a sub-set, but there is no equivalent option for a cloud service that holds your data.
The marking has hardened at the same time. Under the Danzell question set, if any cloud service in scope offers multi-factor authentication (whether free, included in your plan or as a paid extra) and you have not turned it on, the whole assessment fails automatically. Our Cyber Essentials MFA requirements page covers that rule in detail.
Who implements each control: IaaS, PaaS and SaaS
You are always responsible for making sure every control is in place, but the provider may implement some of them for you. Who does what depends on the type of service. The table below is our summary of the NCSC's guide to who would typically implement each control.
| Control | IaaS (virtual servers and networks) | PaaS (you supply the application) | SaaS (you configure the application) |
|---|---|---|---|
| Firewalls | You and the provider | Mainly the provider, sometimes you | The provider |
| Secure Configuration | You and the provider | You and the provider | You and the provider |
| Security Update Management | You and the provider | You and the provider | The provider |
| User Access Control | You | You | You |
| Malware Protection | You and the provider | Mainly the provider, sometimes you | The provider |
The NCSC gives examples of each type: Amazon EC2, Google Compute Engine and Rackspace for IaaS; Azure Web Apps and AWS Lambda for PaaS; Microsoft 365, Dropbox and Gmail for SaaS.
The row that never changes is User Access Control. Whoever hosts the service, you decide who has an account, what privileges they hold, whether admin accounts are separate, when leavers are removed and whether MFA is enforced.
Provider commitments and trust centres
Where you rely on the provider to implement a control, the provider must have committed to doing so in the contract, or in documents the contract refers to, such as a security statement or privacy statement. Large providers usually publish this in a trust centre that describes their shared responsibility model.
For mainstream platforms this is rarely a problem, but it is worth checking for smaller or specialist SaaS. Keep links to the relevant pages: they make answering the cloud questions in the question set quicker and give you an answer ready if your assessor asks.
What you still have to configure
SaaS such as Microsoft 365 and Google Workspace. The provider runs the infrastructure, patches the platform and filters malware on its side. You are responsible for:
- MFA for every user and every administrator
- separate admin accounts used only for administration, with day-to-day work done from standard accounts
- an account approval process, and removing leavers and inactive accounts promptly
- secure settings such as changed defaults and unneeded features or accounts disabled
IaaS such as virtual machines in Azure or AWS. You are responsible for most of what you would do on a physical server: patching the operating system and applications within 14 days, malware protection, firewall rules or security groups that block unauthenticated inbound traffic, and keeping management interfaces off the internet unless properly protected. At Cyber Essentials Plus, the external scan covers IaaS IP addresses and the authenticated patch scan can include IaaS hosts. See Cyber Essentials Plus vulnerability scans.
PaaS. The provider manages the platform; you manage the application, its configuration, its users and access.
Finding every cloud service you use, and how we help
It is easy to underestimate how many cloud services you use. Good places to look are card and invoice records for subscriptions, the list of apps connected to your identity provider through single sign-on or consent grants, and a quick survey of each team. Then record, for each service, who owns it, the type (IaaS, PaaS or SaaS), whether MFA is available and enforced, and where the provider's security commitments are published.
We carry out this inventory as part of our gap analysis, then review the configuration of your main tenants against the controls. For Microsoft 365 that usually means a Microsoft 365 security assessment covering MFA, admin roles and legacy sign-in methods. To get your cloud estate assessment-ready, contact us.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Microsoft 365 in scope for Cyber Essentials?
Yes. Microsoft 365 is a cloud service that holds organisational data, so it must be in scope and cannot be excluded. Microsoft implements several controls on its side, but you remain responsible for user access control, including MFA for every account and separate admin accounts.
Do I need MFA on every cloud service for Cyber Essentials?
Yes. The NCSC requirements say authentication to cloud services must always use MFA. Under the Danzell question set, leaving MFA off a cloud service that offers it, free, included or for a fee, is an automatic fail of the whole assessment.
Can I exclude a cloud service that only one team uses?
No. Requirements v3.3 states that cloud services hosting your data or services cannot be excluded from scope. Either bring the service up to standard, including MFA, or stop using it for organisational data before you apply.
Is AWS or Azure infrastructure in scope?
Yes. Virtual servers and networks you run in public cloud are IaaS and are in scope. You share most controls with the provider, so you are responsible for patching, malware protection, firewall rules and user access on the systems you manage.
What evidence do I need from cloud providers?
Where the provider implements a control for you, it must have committed to it in the contract or in documents the contract refers to, such as a security statement. Trust centre pages describing the provider's shared responsibility model are the usual source.