In short: Cyber Essentials scope is the set of networks, devices, software and cloud services your assessment covers. Under Requirements v3.3 it is either the whole organisation or a well-defined, separately managed sub-set segregated by a firewall or VLAN. End-user devices must be included, cloud services can never be excluded, and every in-scope legal entity must be listed.
What scope means in Cyber Essentials
In the NCSC's *Cyber Essentials: Requirements for IT Infrastructure* v3.3, scope is the collection of networks, hardware, software and cloud services included in your assessment. Before the assessment starts you agree it with your Certification Body, and you describe its boundary in three ways: the business unit that manages it, the network boundary and the physical location.
Inside that boundary, the five technical controls apply to every device and piece of software that does any of the following:
- accepts incoming network connections from devices connected to the internet
- makes outbound connections to devices over the internet
- controls the flow of data between those devices and the internet
In practice that covers almost everything: laptops, desktops, phones and tablets used for work, servers, routers and firewalls, virtual machines and the cloud services that hold your data. "Software" is broad too. It includes operating systems, commercial off-the-shelf applications, extensions, interpreters, scripts, libraries, network software and firewall and router firmware, which is why firmware updates matter under security update management.
Whole organisation or a sub-set
You can certify the whole IT estate you use to run the organisation, or a well-defined and separately managed sub-set. A sub-set is a part of the organisation whose network is segregated from the rest by a firewall or VLAN, and it can be used to draw a line around what is in scope or around what is out.
| Whole organisation | Sub-set | |
|---|---|---|
| What is assessed | All IT used to carry out the organisation's business | Only the segregated part you define |
| Segregation needed | No | Yes: a firewall or VLAN between the sub-set and everything else |
| Justification | None needed | You must explain the partial scope to your assessor |
| Buyer confidence | Highest: the NCSC says a whole-organisation scope gives the best protection and maximises customer confidence | Buyers may read the scope description and ask what was left out |
| Included insurance | IASME's included cyber liability insurance applies to eligible organisations that certify the whole organisation | Not eligible for the included insurance |
Sub-sets are most often used to wall off something that cannot meet the controls, such as a legacy system running unsupported software. In that case the sub-set must have no internet traffic at all, and the rest of the organisation is certified around it. If you go on to Cyber Essentials Plus, the assessor checks the segregation technically before testing starts, so a sub-set has to be real, not just a line on a diagram.
What must always be in scope
Some things cannot be left out, whichever scope you choose:
- End-user devices. A scope with no laptops, desktops, tablets or phones is not acceptable.
- Cloud services. If your data or services are hosted in the cloud, those services are in scope. Version 3.3 states plainly that cloud services cannot be excluded. See cloud services and Cyber Essentials.
- User-owned devices that reach organisational data or services, such as a personal phone with work email. See BYOD and home working.
- Home and remote working devices, plus any router you supply to a home worker.
- Every account your organisation owns, including those used by a managed service provider, supplier or contractor to support your IT. If someone else administers your systems remotely, you must still be able to show the controls are met.
- Devices you own and lend to third parties.
- Publicly available commercial web applications you use. Bespoke or custom-built components of web applications are out of scope, though the NCSC points developers to the Software Security Code of Practice.
Wireless devices, including access points, are in scope if they can communicate with other devices over the internet. They are out of scope if an attacker could only reach them from within signal range, or if they are part of an internet service provider's router at a home or remote location.
Devices you do not own
Version 3.3 includes a table setting out which devices owned by other people are in scope. We have summarised it below.
| Who uses the device | Owned by you | Owned by a third party | Their own device (BYOD) |
|---|---|---|---|
| Employee | In scope | Not applicable | In scope |
| Volunteer | In scope | Not applicable | In scope |
| Trustee | In scope | Not applicable | In scope |
| University research assistant | In scope | Not applicable | In scope |
| Student | In scope | Not applicable | Out of scope |
| MSP administrator | In scope | Out of scope | Out of scope |
| Third-party contractor | In scope | Out of scope | Out of scope |
| Customer | In scope | Out of scope | Out of scope |
Out of scope does not mean out of mind. The NCSC is clear that you remain responsible for making sure devices that touch your services and data are configured properly; you simply choose how to do that outside the assessment. This matters for charities, whose volunteers and trustees often use their own laptops, and for schools and colleges with student devices on the network.
Legal entities and how scope appears on your certificate
The Danzell question set, in use for assessments opened from 27 April 2026, changed how scope is recorded:
- You list every legal entity in scope, with its name, address and company number. A group that wants a separate certificate for each entity can request individual certificates for a small additional fee; each shows that it is part of a wider scope.
- A detailed description of the scope appears on the digital certificate platform, so buyers can see what was assessed. Descriptions of areas you excluded are not made public.
- The "point in time" the certificate reflects is the date the certificate is issued.
Because buyers can look up certificates through IASME's certificate search, a vague or narrow scope can cost you a contract even when you pass. Our guide to checking a Cyber Essentials certificate explains what a buyer sees.
Common scope mistakes, and how we help
The scoping errors we see most often are:
- leaving out a cloud service because "it's only used by one team", or forgetting free tools signed up with a work email address
- forgetting staff who read email on their own phones
- drawing a sub-set without any real firewall or VLAN behind it
- omitting a subsidiary or trading entity that buyers expect to see on the certificate
- leaving a Windows 10 machine without Extended Security Updates inside scope (see Windows 10 and Cyber Essentials)
We start every engagement by agreeing scope with you: an inventory of devices, operating systems, networks and cloud services, a simple network diagram, the list of legal entities and a draft scope description in the wording you will use in the question set. That feeds directly into our gap analysis and remediation work, before you ever reach the assessor. To get your scope right first time, contact us.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Can I exclude part of my organisation from Cyber Essentials?
Yes, if the excluded part is separated from the in-scope part by a firewall or VLAN and you can justify the partial scope to your assessor. You cannot exclude end-user devices altogether or exclude cloud services. Only whole-organisation certificates qualify for IASME's included cyber liability insurance.
Are home workers in scope for Cyber Essentials?
Yes. All corporate and user-owned devices that home or remote workers use for your business are in scope, as is any router you give them. Routers you do not supply are out of scope, so those devices need a software firewall. With a corporate VPN, the boundary moves to your company or cloud firewall.
Can I leave Microsoft 365 out of my Cyber Essentials scope?
No. Under Requirements v3.3, cloud services that host your data or services must be in scope and cannot be excluded. Microsoft 365, Google Workspace and similar services are assessed, and missing MFA on them is an automatic fail under the Danzell question set.
Are devices used by our IT provider in scope?
The accounts your managed service provider uses on your systems are in scope, because your organisation owns them. Devices owned by the MSP or its staff are out of scope, but you must still be able to show that remote administration of your systems meets the Cyber Essentials controls.
Do I need to list every company in our group?
Under the Danzell question set you list every legal entity included in the scope, with its name, address and company number. Entities that are not listed are not covered by the certificate, so include every company buyers will expect to see. Individual certificates per entity are available for a small extra fee.