Cyber Essentials scope: what's in, what's out, and why it comes first

Before you answer a single technical question in Cyber Essentials, you need to decide what the assessment covers. That's the scope. The NCSC's advice is to set the boundary of scope first, then work out what's in scope within it. If the scope is wrong, the rest of your answers describe the wrong set of devices.

This guide goes through what the NCSC's requirements say about Cyber Essentials scope, in the order most small businesses run into it. It uses the current versions: the NCSC's Requirements for IT Infrastructure v3.3 (April 2026) and IASME's Danzell question set, version 16.3 (May 2026).

What "scope" means

The NCSC defines scope as "the networks, hardware and software assets, and cloud services that are included in the assessment". Within that scope, the requirements apply to devices and software that can accept incoming connections from internet-connected devices or make outbound connections via the internet. They also apply to anything that controls the flow of data between those devices and the internet. The NCSC's Cyber Essentials overview explains the scheme.

Whole organisation or part of it

The NCSC says your assessment should cover the whole of the IT infrastructure you use to run your business. If necessary, it can cover a well-defined and separately managed sub-set instead. Either way, you have to define the boundary: the business unit managing it, the network boundary and the physical location. You must also agree the scope with your Certification Body before the assessment begins.

A sub-set is part of the organisation whose network is kept apart from the rest by a firewall or VLAN. If you leave part of your infrastructure out, you'll need to justify the partial scope to your assessor. The NCSC adds that organisations which choose a scope covering their whole IT infrastructure "achieve the best protection and maximise their customers' confidence".

The question set asks about this directly. Question A2.1 asks whether the assessment is for your whole organisation or only part of it. If you certify only part, IASME says the scope description on the certificate will say "Partial Organisation, see certificate platform for details". That's worth knowing if a customer has asked for Cyber Essentials and expects it to cover the work you do for them.

Two things you can't leave out

Two rules catch people out.

• A scope that doesn't include end-user devices isn't acceptable.
• If your data or services are hosted on cloud services, those services must be in scope. The NCSC says cloud services cannot be excluded from scope.

So "just the office server" won't work as a scope. The laptops, desktops, tablets and phones that reach your data count. So do services like Microsoft 365, Dropbox and Gmail, which the NCSC gives as examples of software as a service.

With cloud services, your organisation is always responsible for all the controls being in place. The provider may carry out some of them for you. Where it does, the NCSC says the provider must have committed to this in the contract, or in documents the contract refers to, such as security statements.

Personal phones and laptops (BYOD)

Devices owned by your staff that access your organisation's data or services are in scope. There's one exception. Mobile or remote devices used only for native voice apps, native text apps or multi-factor authentication (MFA) apps are out of scope.

In practice, a personal phone that only makes calls, sends texts and runs an authenticator app is out of scope. If it also opens work email, it's in.

Home working and routers

The NCSC's default is that all corporate or BYOD devices used for home or remote working are in scope. If you give a home worker a router, that router is in scope too.

Other home routers are out of scope. That means the firewall controls, such as a software firewall, need to be applied on the user's devices instead. If the home worker uses a corporate VPN, their internet boundary is on the company firewall or the virtual or cloud firewall.

Wireless access points are in scope if they can communicate with other devices via the internet. They're out of scope if an attacker can't reach them directly via the internet, or if they're part of an ISP router at the home or remote location.

Suppliers and your MSP

All accounts your organisation owns are in scope. That includes accounts a supplier, contractor or managed service provider (MSP) uses to manage or support your infrastructure. Devices you own and lend to a third party must be included as well.

For devices you don't own, the NCSC's table puts employees' own devices in scope. Devices owned by an MSP administrator, a third-party contractor or a customer are out of scope. Even so, you're still responsible for confirming that devices which interact with your services and data are configured correctly. The NCSC leaves it to you how you do that, because it falls outside the assessment scope.

Web applications

Publicly available commercial web applications are in scope by default. Bespoke and custom components of web applications are out of scope.

What the questions ask you to list

Once you've drawn the boundary, the Danzell questions ask you to describe what's inside it. They ask for the networks in scope (A2.4) and the network equipment in scope (A2.5). They also ask for your laptops and desktops (A2.6), servers and virtual servers (A2.7), tablets and mobile devices (A2.8), and every cloud service you use that a third party provides (A2.9). If you're certifying part of the organisation, you also describe the scope and any networks you've left out (A2.2 and A2.2.1).

So it helps to build your device and cloud list before you open the assessment platform. The NCSC says asset management isn't a specific Cyber Essentials control, but that good asset management can help meet all five controls.

The user accounts in scope change as people join, change role or leave. Our Joiners, Movers and Leavers Access Checklist has a checklist for each of those moments.

A scope checklist

• Decide whether it's the whole organisation or a sub-set. If it's a sub-set, note the firewall or VLAN that separates it.
• List every end-user device that reaches your data, including personal phones that do more than calls, texts and MFA.
• List every cloud service that holds your data or runs your services.
• Note any routers you've given to home workers.
• List the accounts that suppliers or an MSP use.
• Agree the scope with your Certification Body before the assessment begins.

Help with the questions

Not sure where to begin? Our Small Business Cyber Starter Checklist has a topic for when a customer asks for Cyber Essentials. It includes a few first checks you can do yourself.

Ad – our own product. If you'd like Cyber Essentials question help, our Cyber Essentials Questionnaire Prep Kit (£39) has a scope and devices worksheet and a cloud services worksheet. It also walks through every Danzell section in plain English. It's self-serve. You work through the files yourself, with no calls or meetings with us.

Preparation only, not certification. The kit isn't made or endorsed by IASME or the NCSC, and Secordit isn't a Certification Body. Only an Assessor working for a Certification Body licensed by IASME can assess your answers and issue Cyber Essentials certification. General information, not legal advice.