Cyber Essentials
Your Cyber Essentials scope is the part of your organisation’s IT that a Cyber Essentials certificate covers. You declare it when you apply, agree it with your certification body before the assessment starts, and it appears on the certificate as a scope statement. The scheme expects the scope to be the whole of the IT your business runs on, or a clearly separated and separately managed part of it, and some things, including staff devices and cloud services, cannot be left out.
This guide is for organisations preparing for Cyber Essentials or Cyber Essentials Plus, and for the person deciding what goes into the scope. It covers whole-organisation and partial scopes, devices and home working, cloud services, websites and suppliers, how scope affects Plus testing, and example scope statements, all written to version 3.3 of the scheme’s requirements. If you are checking what a supplier’s certificate covers rather than setting your own, my article on reading a certificate’s scope deals with that side.
The National Cyber Security Centre (NCSC) sets the scoping rules for the scheme in its Cyber Essentials Requirements for IT Infrastructure, now at version 3.3. An assessment covers either the whole of the IT used to run your business or a well-defined sub-set that is managed separately, described by the business unit that manages it, its network boundary and its location. The scope is agreed with your certification body before the assessment begins, and a partial scope has to be justified to the assessor.
A Cyber Essentials sub-set only works when it is genuinely separate. The requirements expect it to be segregated from the rest of the network by a firewall or a virtual local area network (VLAN), so a list of departments sharing one network does not qualify, and a scope that leaves out end user devices is not acceptable either. One legitimate use of a sub-set is to take an older, unsupported system out of scope by placing it on a segment with no internet access.
I would start from whole organisation and move to a sub-set only where there is a clear reason, such as a contract that names one environment already separated from the rest. A narrow scope is not a weaker certificate, but it covers less, and a customer running a Cyber Essentials supplier check can read the scope statement as easily as the certification level.
Every device that connects to or from the internet and handles your organisation’s data or services is in scope for Cyber Essentials, whether it is physical or virtual. That includes servers, network equipment such as firewalls and routers, and end user devices: desktops, laptops, thin clients, tablets and smartphones. Firewall and router firmware counts as software, so its updates matter as much as a laptop’s.
Home working is in scope by default. A router your organisation supplies to a home worker is in scope, while a router supplied by the employee’s internet service provider (ISP) is not, which means the firewall control, one of the five Cyber Essentials controls, has to be met on the device itself, usually through its software firewall. Where staff connect through a corporate virtual private network (VPN), the boundary moves to the company or cloud firewall the traffic passes through.
Personal devices need the most care when a scope is being set. Under the bring your own device (BYOD) rules, a personal phone or tablet that reaches organisational data or services, such as work email or a shared drive, is in scope, while a phone used only for ordinary calls, texts or an authenticator app for multi-factor authentication (MFA) is not. Employees’, volunteers’ and trustees’ devices are treated the same way, while devices owned by contractors, customers or your managed service provider (MSP) are out of scope, although you remain responsible for checking they are configured properly when they connect to your services.
If I were preparing a first application, I would start with three lists that take under an hour to pull together: the devices in your device management system or asset register, the user accounts in your email service along with the devices each one signs in from, and any routers you have sent out to home workers. Comparing the three shows which personal devices are reaching work data and which home routers are yours to manage.
Cloud services that hold your data or run your services are in scope, and the requirements state plainly that “cloud services cannot be excluded from scope.” That covers email and document platforms, accounting and customer systems, and servers rented from a cloud provider. What varies between services is who carries out each control, not whether the service counts.
The requirements split responsibility by service model. With infrastructure as a service (IaaS), the provider supplies virtual servers and networks that you configure and manage, so most controls are shared or yours. With platform as a service (PaaS), the provider runs the underlying infrastructure and you manage the applications on it. With software as a service (SaaS), the provider normally handles firewalls, malware protection and security updates, but you remain responsible for configuring the service securely.
User access control stays with you whatever the model, which in practice means accounts, administrator rights and MFA, and MFA has to be switched on for cloud services wherever the service offers it. Where a provider carries out a control for you, that commitment needs to be in the contract or in a referenced document such as a published security statement. The same applies when an MSP runs services on your behalf: you need to be able to confirm the controls are met and show it in your assessment answers.
Whether a website is in scope for Cyber Essentials depends on what it is built on, who runs it and what it holds. The requirements treat publicly available commercial web applications as in scope by default, while bespoke and custom-built components are out of scope, and the NCSC points organisations to its Software Security Code of Practice for those instead.
Web servers are rarely part of the scopes I assess, usually for good reasons. Many organisations’ websites hold only public information, and many are hosted by a provider that is responsible for the server’s security under its contract. The position changes when the site holds customer data, handles logins or payments, or runs on a server your own team maintains, and that is worth raising with your certification body when the scope is agreed.
A website outside your scope still needs someone looking after it. In October 2026 the NCSC urged UK organisations to update PHP, the programming language behind a large share of websites, after two critical flaws were found that could let an attacker run code on a web server without logging in. Being outside a Cyber Essentials scope made no difference to whether a site needed the update, and I would ask your hosting provider, in writing, which version of PHP or other server software your site runs on and how quickly they apply critical updates.
Your certificate covers the systems you control, but a supplier with access to your data or your network can still be the route an attacker uses. The NCSC’s Cyber Essentials Supply Chain Playbook sets out how to ask suppliers for certification, and the IASME certificate search lets you check whether a supplier is certified and read its scope statement. I would start with the suppliers who hold your data or have administrator access to your systems, including your hosting provider and any MSP.
Cyber Essentials Plus adds hands-on technical verification to the self-assessment that the base certificate relies on, and it tests the scope you have declared. Testing includes external and internal vulnerability scanning, a sample of your devices and checks on MFA for your cloud services, as covered in my article on the Cyber Essentials Plus changes under version 3.3. The sample is drawn from the declared scope, so an accurate list of in-scope devices matters as much for Plus as for the self-assessment.
Version 3.3 also changed what happens when a sample fails. Where the first sample shows missing security updates, the fixes have to be applied across the whole declared scope, and the assessor then tests a second sample of different devices. Once Plus testing starts, the self-assessment answers are locked, so a scope that turns out to be wrong is recorded as a finding rather than corrected. I would settle the scope in writing with your certification body before booking Plus testing, including how home workers’ devices and cloud services will be sampled.
A Cyber Essentials scope statement is a short description of what the certificate covers. The four examples below are illustrative rather than taken from real certificates, and your certification body will confirm the wording on yours.
A 40-person professional services firm with company laptops, staff phones that receive work email, a cloud email and document platform and a cloud accounting system would normally declare its whole organisation. Its scope statement would read “whole organisation”, covering every laptop, every phone reaching work data, both cloud services and the office router.
A charity with a hybrid team and no office network would also declare its whole organisation, with most of its scope sitting in home working and personal devices. Volunteers’ and trustees’ devices that reach the charity’s email are in scope, the ISP routers in their homes are not, and each device’s software firewall carries the firewall control.
A manufacturer that needs Cyber Essentials for one defence contract might certify only the engineering network that holds the contract data, provided it is separated from the rest of the business by a firewall. Its scope statement would name that network, the team that manages it and its location, and end by excluding all other networks. That is a valid scope, and Defence Cyber Certification Level 0 is one reason suppliers are weighing it, but a buyer reading it will see exactly what it leaves out.
A small online retailer running its own web server on rented cloud infrastructure is in a different position. Because the server holds customer accounts and order data on a cloud service, it belongs in scope with the cloud account it runs in, and the retailer keeps its operating system and web software up to date.
No. Cyber Essentials can cover the whole organisation or a well-defined sub-set that is managed separately and segregated from the rest of the network by a firewall or virtual local area network. A partial scope has to be justified to the assessor and agreed with the certification body before assessment, and it cannot exclude end user devices. Whole organisation gives the widest protection and is the scope buyers are most likely to look for.
It depends on how the website is built, hosted and used. Publicly available commercial web applications are in scope by default, while bespoke or custom-built components are out of scope. A site holding only public information and run by a hosting provider is often agreed as outside scope, but a site on a server you manage yourself, or one that holds customer data, should be discussed with your certification body when the scope is agreed.
A router your organisation supplies to a home worker is in scope. A router supplied by the employee’s internet service provider is out of scope, so the firewall requirement has to be met on the laptop or other device itself, usually with its built-in software firewall. Where staff connect through a corporate virtual private network, the boundary is the company or cloud firewall that the traffic passes through.
Yes. A personally owned phone or tablet that accesses organisational data or services, including work email, is in scope under the bring your own device rules and has to meet the same controls as a company device. A phone used only for ordinary calls, texts or a multi-factor authentication app is out of scope.
No. Cloud services that hold your data or run your services must be included in scope. The provider may carry out some controls, such as security updates on a software as a service platform, but the organisation remains responsible for making sure every control is in place, including user access control and multi-factor authentication wherever the service offers it.
Your certificate covers the systems you control, not your suppliers’ systems. A supplier with access to your data or network can still be a route into your organisation, so it is reasonable to ask key suppliers, such as your hosting provider or managed service provider, whether they hold Cyber Essentials, and to check the scope on their certificate using the IASME certificate search.
Safeguard your business with our expert cyber security solutions. Whether you require digital forensics, penetration testing or proactive security assessments, our team is ready to assist. Contact us today to discuss your security needs and take the first step towards a more secure future.
