Cyber Essentials scope is the boundary that defines which parts of your organisation — which devices, networks, cloud services, accounts and people — your certification actually covers. It is the first thing you decide when applying, it appears on the certificate itself, and it is the decision that most often causes a self-assessment to misrepresent a business’s real security position. Draw the boundary too narrowly, or in the wrong place, and you can hold a valid certificate that says very little about the systems your business actually depends on.
Most applicants treat scope as a box to fill in before getting to the “real” questions about firewalls, patching and passwords. That is understandable, because the technical controls feel like the substance of the scheme. But every answer in the questionnaire is an answer about the systems inside the boundary. A perfectly patched head office network tells customers, insurers and auditors little if the certificate quietly excludes the home workers’ laptops, the personal phones that read company email and the cloud platform holding customer data.
This guide starts with why scope decisions matter more than most applicants realise, then covers whole-organisation versus sub-set scoping and what a sub-set requires technically, how BYOD devices, home working and cloud services fall in or out of scope, the risk of scoping out insecure systems to pass more easily, and how assessors, customers and insurers treat a certificate whose scope does not match the business’s real exposure. The scheme’s requirements are published and updated periodically by the National Cyber Security Centre and IASME; always check the current version when applying, as details change between versions.
What Cyber Essentials scope means
The scope is a description of the part of the organisation being assessed. Within that boundary, every internet-connected device, service and account must meet the scheme’s technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Outside it, the certificate makes no claim.
Broadly, the scope includes:
- End-user devices — desktops, laptops, tablets and mobile phones that can connect to the internet and access organisational data or services, whether company-owned or, in many cases, personally owned.
- Servers — physical, virtual and cloud-hosted.
- Network devices — firewalls, routers and other devices that provide the boundary between your networks and the internet.
- Cloud services that hold or process organisational data, including software, platform and infrastructure services.
- User and administrator accounts that access in-scope devices and services.
The scope can be the whole organisation or a defined sub-set, such as a particular business unit, office or network. If a sub-set is chosen, it must be separated from the rest of the organisation by a technical boundary, and the certificate describes what is covered. A certificate for “the whole organisation” and one for “the London office network” are very different statements, even though both are valid Cyber Essentials certificates.
Before deciding scope, list how staff actually access company email, files and systems: which devices, from where, using which cloud services and accounts. Scope drawn from an accurate picture of real working practice is far more likely to be right than scope drawn from a network diagram or an asset register that has not been updated since before hybrid working.
Why scope decisions matter more than applicants realise
Scope looks like an administrative detail. In practice it determines what the certificate means, how much work certification requires, and whether the business can rely on it later.
It defines what the certificate claims
A certificate tells customers, insurers and procurement teams that the systems within scope met the controls at the time of assessment. If key systems sit outside scope, the certificate does not cover them, however reassuring the badge on the website looks.
Every answer depends on it
The self-assessment questions ask whether in-scope devices are patched, configured securely, protected against malware and so on. If the scope is wrong, every answer is about the wrong set of systems, and the questionnaire can be completed truthfully while the business’s actual exposure goes unexamined.
It is signed off by a senior person
The self-assessment must be approved by a board-level or equivalent senior person, who declares that the answers are accurate. A scope that does not reflect reality puts that declaration at risk.
Customers and insurers rely on it
Contracts, supplier questionnaires and insurance proposals often ask simply whether the organisation holds Cyber Essentials. If the certificate covers only part of the business and is described as though it covers everything, the gap can surface at the worst moment: during a contract dispute, a security incident or an insurance claim.
It determines the work involved
Scope also drives effort and cost. Whole-organisation scope means every device, account and cloud service must meet the controls. A sub-set can reduce that effort, but only if the separation is genuine, which has its own cost. Understanding the trade-off early avoids surprises halfway through preparation.
Cyber Essentials scope in practice — the numbers
The figures below are indicative, drawn from Cyber Essentials readiness reviews we carry out for UK organisations before submission. They are not a formal survey, but the pattern is consistent.
The last figure surprises many applicants. Smaller organisations often assume a narrow sub-set will be easier, then discover that creating and evidencing genuine separation costs more effort than bringing everything up to standard. For most small and medium-sized businesses, whole-organisation scope is not only the most credible option but also the simplest.
The most common scoping errors
The chart shows how often each error appears in the draft applications we review. Many drafts contain more than one, so the figures add up to more than 100%.
The top three share a cause: the scope was drawn around the office rather than around how people work. Hybrid working has moved much of the real attack surface onto home networks, personal devices and cloud services, and scopes written with an office network in mind miss it. The fourth reflects a different problem: a sub-set described on paper without the technical boundary the scheme requires. Our earlier guide to scoping a Cyber Essentials Plus assessment lists what must be included device by device; the rest of this guide focuses on the decisions behind the boundary.
Whole-organisation versus sub-set scoping
The first real decision is whether to certify the whole organisation or a sub-set. Both are legitimate. The right answer depends on how the business is structured, why it is seeking certification and what customers or insurers expect.
Whole-organisation scope
Every in-scope device, server, network device, cloud service and account across the organisation must meet the controls. The certificate states that the whole organisation is covered, which is the simplest and most credible statement to customers, procurement teams and insurers. For most small and medium-sized businesses, particularly those with a single network and shared cloud services, this is the natural choice. It is also, in our experience, the option least likely to cause problems later, because there is no boundary to maintain or explain.
Sub-set scope
A defined part of the organisation is certified, with the rest excluded. Sub-set scoping makes sense in a limited number of situations: a large organisation where only one business unit needs certification for a specific contract; a separate network for a particular service with its own infrastructure; or a legacy environment that cannot meet the controls and is genuinely isolated from everything else.
What a sub-set requires
A sub-set is not simply a list of the devices you would like to include. The scheme requires the in-scope part of the organisation to be separated from out-of-scope systems by a technical boundary, typically a firewall or properly configured network segmentation that prevents traffic between them. People, devices and accounts inside the sub-set should not be able to reach out-of-scope systems in ways that undermine the boundary, and shared cloud services and accounts make clean separation harder than it first appears. If staff in the sub-set use the same Microsoft 365 tenant, the same administrator accounts or the same laptops as the rest of the organisation, the separation may not hold.
How the scope is described
For a sub-set, the scope description should make clear what is covered — for example, a named business unit, location or network — and it appears on the certificate. Vague descriptions, or ones that sound broader than the sub-set really is, invite exactly the misunderstanding that causes trouble later. Write the description so that a customer reading it would correctly understand what is and is not certified.
What each scoping choice costs
The table compares the indicative effort and cost involved in different scoping approaches for a typical UK SME of 30 to 150 staff. Figures are broad ranges and depend on the starting position, the number of devices and services, and whether work is done in-house or with support.
| Scoping approach | Typical preparation effort | Indicative additional cost | Main risk |
|---|---|---|---|
| Whole organisation, already well managed | Days of evidence gathering and minor fixes | Certification fee plus modest support | Overlooking BYOD or cloud services |
| Whole organisation, gaps to close | Weeks of remediation across devices and accounts | £2,000 to £10,000 in remediation and support | Underestimating the number of devices and services |
| Sub-set with existing separation | Evidence of the boundary plus in-scope remediation | Modest, if separation is already genuine | Shared accounts or services undermining separation |
| Sub-set requiring new separation | Network redesign, separate accounts and services | £3,000 to £20,000 or more in network and licensing changes | Separation costing more than remediating everything |
| Sub-set chosen to exclude weak systems | Appears lower; real exposure unchanged | Low up front | Certificate that misrepresents real exposure |
The table shows why sub-set scoping is less of a shortcut than it appears. Where separation already exists for good operational reasons, a sub-set can be efficient. Where it has to be created, the cost of redesigning networks and separating accounts and cloud services often exceeds the cost of bringing the whole organisation up to standard. And the last row, using a sub-set mainly to leave weak systems outside the boundary, saves effort only by leaving the real risk unaddressed.
Sub-set scoping versus whole-organisation scope
The comparison sets the two approaches side by side for a typical SME.
Sub-set scope
A defined part of the organisation certified
Whole-organisation scope
Everything the organisation uses is certified
Whole-organisation scope is highlighted not because sub-sets are wrong, but because for most SMEs it is both the most honest and the least complicated option. Where a sub-set is genuinely the right answer, the key is to make the separation real and the description precise.
Scoring three scoping scenarios
The score grid compares three scenarios we commonly see. Here a high badge means a high level of concern on that dimension, except for the first row, where high means high credibility.
The whole-organisation scenario asks the most of remediation but the least of everything else. A genuinely separate contract team network can be a sensible sub-set, provided the boundary is real and maintained. The third scenario — a sub-set drawn mainly to exclude systems that would fail — scores worst on the dimensions that matter most later: credibility, accurate representation of risk and the chance of a dispute when something goes wrong.
BYOD scope: when personal devices are in
Personally owned devices are one of the most frequently mis-scoped areas. Under the current requirements, user-owned devices that access organisational data or services — such as company email, files, line-of-business applications or cloud platforms — are generally in scope, and must meet the same controls as company-owned devices. That includes personal phones with work email, personal laptops used to access company files, and tablets used for work applications.
There are limited exceptions. Devices used only for native voice calls and text messages, or only for multi-factor authentication apps, are generally treated as out of scope. Check the current requirements for the precise wording, as it has been refined between versions.
Organisations therefore have three broad options for BYOD scope Cyber Essentials decisions:
- Bring personal devices into scope and manage them. Typically through device management or work profiles that let the organisation enforce updates, screen locks and other controls without intruding on personal use.
- Prevent personal devices from accessing organisational data. Use access policies so that only managed, company-owned devices can reach email, files and applications.
- Provide access through controlled routes. Approaches such as virtual desktops can change how devices are treated, depending on configuration; confirm with your certification body how a specific setup is assessed.
What is not acceptable is leaving personal devices out of scope while they continue to access company data. Our guide to BYOD and Cyber Essentials Plus covers the management options in more detail.
Cloud services scope: why you cannot leave them out
Cloud services are now where much of an organisation’s data lives, and the scheme reflects that. Cloud services that hold or process organisational data are in scope and generally cannot be excluded. That covers software as a service such as Microsoft 365, Google Workspace, accounting, CRM and HR platforms; platform services; and infrastructure services such as virtual servers in Azure, AWS or Google Cloud.
Responsibility for meeting the controls is shared between you and the provider, and the split depends on the service type. For infrastructure services, you are responsible for much of the configuration, patching and access control of the virtual machines you run. For software services, the provider handles most of the platform, but you remain responsible for areas such as user accounts, administrator access, multi-factor authentication and secure configuration of the settings you control.
The practical task is to build a complete list of the cloud services the organisation uses, which is often longer than expected once departmental subscriptions, free tools and trial accounts are included, and then to confirm that the controls you are responsible for are in place for each. Our guide to cloud services and Cyber Essentials Plus works through common services and their implications.
Home working and the boundary
Hybrid working changes where the boundary sits. Devices used by home workers to access organisational data are in scope, wherever they are used. Home broadband routers supplied by an internet provider for domestic use are generally treated as out of scope; instead, the firewall controls must be applied on the devices themselves, typically through the operating system’s software firewall. Where the organisation supplies and manages a router or firewall for a home worker, that device is generally in scope.
This shifts much of the practical burden onto device management. Home workers’ laptops need to be kept up to date, configured securely and protected against malware without relying on an office firewall. Organisations with good central device management find this straightforward; those relying on staff to update their own devices often find it is where gaps appear.
Edge cases worth checking with your certification body
Most scoping decisions follow clearly from the rules above, but some arrangements sit in grey areas or depend on configuration. These are worth raising with your certification body before submission rather than guessing.
- Virtual desktops and thin clients. How the access device and the virtual desktop are each treated can depend on the setup, including whether the access device is managed and what it can do beyond connecting to the virtual desktop.
- Shared and kiosk devices. Reception computers, meeting room devices and shared workstations used by several people are easily forgotten, but if they connect to the internet and access organisational services, they are likely to be in scope.
- Development and test environments. Cloud environments used for testing or development may hold real data or connect to production systems. If they do, treat them as in scope.
- Loan and spare devices. Laptops kept in a cupboard for new starters or loans still need to meet the controls when they are used, so include them in the inventory and keep them updated.
- Specialist equipment. Manufacturing, laboratory, medical or building management systems often run software that cannot be updated on the normal schedule. Whether and how they can be excluded depends on their connectivity and the current requirements.
- Devices used by more than one organisation. Staff who work across group companies or for a client on the client’s devices raise questions about whose scope those devices fall within.
Documenting how each edge case was resolved, and on whose advice, is useful at renewal and if questions arise later.
How Cyber Essentials Plus tests the scope
Cyber Essentials Plus adds an independent technical assessment to the self-assessment, and scope is where many organisations first feel the difference. With the basic certification, the scope is largely what you declare. With Plus, an assessor checks it.
The assessor typically works from the scope and device information in your verified self-assessment, then tests a sample of in-scope end-user devices, cloud services and externally facing systems. The sample is drawn from across device types and operating systems, so a scope listing laptops, phones and tablets will see each tested. Where personal devices are in scope, some may be included in the sample, which is one reason organisations sometimes reconsider whether personal devices should access company data at all.
Assessors also look for consistency. If the scope declares a certain number of devices but the device management console shows many more, or the declared cloud services do not match what staff are clearly using, expect questions. A sub-set scope will need its boundary demonstrated, not just described. The Plus assessment is normally completed within a set period after the basic certification, so the scope agreed for the self-assessment carries straight through; changing it late can mean starting again.
The practical lesson is to prepare the scope as if it will be tested, even if you are starting with the basic certification. An accurate scope makes a later move to Plus straightforward; an optimistic one can make it painful.
Defining the boundary, step by step
The timeline sets out a practical process for defining the certification boundary before starting the self-assessment questions. For most SMEs it takes a few days of elapsed time, and it saves considerably more later.
Steps two and three do most of the work. They are where forgotten personal devices, departmental cloud tools and contractors’ laptops come to light. Step four then reveals whether there is anything that genuinely cannot meet the controls, which is the honest starting point for deciding between remediation and a sub-set.
Writing a scope description that will not be misread
The scope description is short, but it is the part of the certificate that customers, procurement teams and insurers actually read. A good description is specific, accurate and understandable without further explanation.
For a whole-organisation scope, the description is simple: the organisation’s legal name and a statement that the whole organisation is covered. Make sure the legal entity is correct, particularly in groups with several companies, and that trading names customers know are clearly linked to it.
For a sub-set, precision matters more. Compare these two descriptions:
- Vague: “Example Engineering Ltd — main IT systems.” A reader cannot tell what is excluded and is likely to assume everything important is covered.
- Precise: “Example Engineering Ltd — Defence Projects division network at the Bristol site, including its devices, user accounts and dedicated cloud tenant. Excludes all other divisions and the group head office.” A reader knows exactly what is covered and what is not.
The precise version is less flattering, but it protects the business. Anyone relying on the certificate can see its limits, and nobody can later claim to have been misled. If the honest description of a sub-set looks too narrow to satisfy the customer or contract it was meant for, that is a strong sign that whole-organisation scope is the better route.
What draft scopes include
The progress bars show how often each category is correctly included in the draft scopes we review, before any corrections. Figures are indicative.
Categories correctly included in draft scopes
The categories at the top are those visible in an office. Each step down the list is further from the office network and closer to how people actually work now: at home, on phones, on personal devices, in cloud services, through contractors. The pattern reinforces the earlier point — scopes drawn around the building miss much of the real exposure.
The risk of scoping out insecure systems
Faced with a system that would fail — an old server running unsupported software, a production line computer that cannot be updated, a team that refuses device management on personal phones — the tempting response is to draw the boundary around it. Sometimes that is legitimate. Often it is not, and the difference matters.
When excluding a system is legitimate
Where a system genuinely cannot meet the controls and is properly isolated, a sub-set can be appropriate. The current requirements set specific expectations for unsupported systems, typically that they are removed from scope by being placed in a segregated sub-set that cannot reach the internet, or otherwise isolated as the requirements specify. Check the current wording for the conditions that apply. In these cases, the exclusion reflects a real technical boundary, and the certificate accurately describes what is covered.
When it misrepresents the business
Problems arise when the boundary is drawn on paper rather than in the network, or when it excludes systems that are central to the business and connected to everything else. A certificate covering “head office workstations” while the finance system, the warehouse network and the personal phones reading company email sit outside scope may pass assessment, but it does not reflect where the business is exposed.
Why it rarely helps
Attackers do not respect certification boundaries. The excluded system is often exactly the weakest point, and if it is connected to the rest of the network, a compromise there can spread to in-scope systems. The certificate then provides false comfort to the business and to everyone relying on it. Fixing or genuinely isolating the weak system is almost always the better use of effort.
The honest alternative
If a system cannot be fixed before certification, consider whether it can be retired, replaced, isolated properly or brought up to standard on a defined timeline. Where a sub-set is used, describe it precisely, so that anyone reading the certificate understands its limits, and treat the excluded system as a known risk to be managed rather than a problem solved.
How often certificates are described more broadly than their scope
Among the certified organisations we work with, the share that describe their certification to customers or insurers more broadly than the scope actually supports is substantial.
The figure is indicative rather than a formal survey, and almost none of these cases involve an intention to mislead. A certificate is obtained for a sub-set, often for a specific contract; time passes; and someone completing a supplier questionnaire or insurance proposal ticks “yes” to holding Cyber Essentials without rereading the scope. The gap becomes significant only when something goes wrong — and that is when it matters most. Keeping the scope statement visible to everyone who answers such questions avoids most of these cases.
Twelve questions to settle before submitting
The checklist covers the questions that most often reveal a scoping problem. Answer each honestly before completing the self-assessment.
- Why are we certifying, and who will rely on the certificate? Will they expect whole-organisation coverage?
- Have we mapped how every role actually accesses email, files and systems? Including home, mobile and contractor access.
- Are all company-owned laptops, desktops, tablets and phones included? Including those used mainly at home.
- Which personal devices access company data or services? Will we manage them or block their access?
- Have we listed every cloud service that holds or processes company data? Including departmental and free tools.
- Are cloud-hosted servers and virtual machines included? And are our responsibilities for them clear?
- Are all administrator and user accounts covered? Including shared, service and third-party accounts.
- Which systems cannot meet the controls? Can they be fixed, replaced, retired or genuinely isolated?
- If using a sub-set, what is the technical boundary? Could we demonstrate it to an assessor?
- Do shared accounts or services cross the boundary? If so, the sub-set may not hold.
- Would a customer reading the scope description understand it correctly? Without needing an explanation.
- Does the senior person signing the declaration understand what the scope covers? And agree it reflects reality?
Certification bodies can clarify how specific arrangements are treated, such as a particular virtual desktop setup, a shared tenant between two companies, or devices managed by a third party. Asking before submission is far easier than correcting a scope after an assessor has raised questions, and the answer may change your decision between whole-organisation and sub-set scope.
Scope accuracy — where most first-time applicants sit
Combining completeness, accuracy of description, genuineness of any separation and alignment with how the business is presented to others gives an indication of scope accuracy. The gauge reflects a typical UK SME preparing its first application without specialist help.
A score in the mid-forties usually reflects a scope that covers the office well and much of the rest poorly: personal devices partly included, cloud services incompletely listed, contractors forgotten and, where a sub-set is claimed, the boundary described rather than demonstrated. None of this is usually deliberate; it reflects a scope drawn from the most visible parts of the business.
Working through the mapping and inventory steps above typically lifts scope accuracy into the eighties or higher. The improvement comes almost entirely from looking at how people actually work, rather than from any technical change.
How assessors, customers and insurers treat mismatched scope
A certificate whose scope does not match the business’s real exposure can cause problems in several places.
Certification bodies and assessors
For the basic self-assessment, the certification body reviews the answers and may query a scope that looks implausible, such as a business of fifty people declaring only a handful of devices, or no cloud services. For Cyber Essentials Plus, the assessor tests a sample of in-scope devices and services and checks that the scope is consistent with what they find. A scope that excludes obviously relevant systems, or a sub-set without a demonstrable boundary, is likely to be challenged, and may delay or prevent certification.
Customers and procurement teams
Contracts that require Cyber Essentials usually assume it covers the systems that will handle the customer’s data or deliver the contracted service. If the certificate’s scope does not include those systems, the requirement may not be met, whatever the badge says. Some procurement teams now ask to see the scope statement rather than simply a certificate number.
Insurers
Insurance proposal forms often ask whether the organisation holds Cyber Essentials, and some certification packages have included cyber liability cover for eligible small organisations certifying their whole organisation; check current terms and eligibility. If a certificate covers only part of the business and is described as though it covers everything, the mismatch could become relevant if a claim arises from an uncovered system. We cover this in depth in our guide to Cyber Essentials and insurance premiums. Questions about how a specific policy would respond should go to your broker.
The common thread
In each case, the problem is not a sub-set scope as such, but a gap between what the scope says and what others understand it to mean. A precise scope, honestly described, avoids almost all of these issues.
Explaining your scope to customers and in tenders
Once certified, the certificate starts appearing in places far from the people who scoped it: website footers, sales presentations, tender responses, supplier questionnaires and insurance forms. Each is an opportunity for the scope to be described more broadly than it really is.
A few habits keep descriptions accurate. Keep a short, approved form of words describing your certification and its scope, and make it available to sales, bid and finance teams. Where a sub-set is certified, say so plainly whenever the certificate is mentioned: “Our Defence Projects division is certified to Cyber Essentials Plus” rather than “We are Cyber Essentials Plus certified.” Route supplier security questionnaires and insurance proposals to someone who knows what the scope covers, rather than letting whoever receives them answer from memory. And check the expiry date as well as the scope; certificates last a year, and claims made after expiry are a different but equally common problem.
When a customer or tender requires certification of the systems that will handle their data, confirm explicitly that those systems are within your scope, and be ready to show the scope statement. Many procurement teams appreciate the clarity, and a precise answer builds more trust than a general one that later turns out to have exceptions.
Common Cyber Essentials scoping mistakes
The mistakes below account for most of the scope corrections we make before submission.
- Drawing the scope around the office. Hybrid working means much of the exposure is elsewhere.
- Leaving personal devices out while they access company data. Manage them or block their access.
- Listing only the main cloud platform. Departmental and free tools holding company data count too.
- Forgetting contractors and temporary staff. Their devices and accounts may be in scope.
- Claiming a sub-set without a technical boundary. A list of devices is not separation.
- Sharing accounts or tenants across a sub-set boundary. This can undermine the separation entirely.
- Scoping out weak systems that are connected to everything. The risk remains and the certificate misleads.
- Vague scope descriptions. Descriptions that sound broader than the real scope invite misunderstanding.
- Not rereading the scope at renewal. Businesses change; the scope should be revisited every year.
- Describing a sub-set certificate as covering the organisation. On websites, tenders or insurance forms.
The senior person who approves a Cyber Essentials self-assessment is declaring that the answers are accurate. If the scope omits systems everyone knows are in use, or a sub-set exists only on paper, that declaration may be inaccurate. Make sure whoever signs understands exactly what the scope covers and what it does not, and is comfortable that it reflects how the business really operates.
Case study: the sub-set that did not hold
A UK engineering consultancy with around 85 staff needed Cyber Essentials to bid for a public sector framework. Its IT was managed partly in-house and partly by a provider. To move quickly, the team proposed a sub-set covering the “project delivery” team of about 30 people, on the basis that they would handle framework work, while excluding finance, the directors and a small CAD workstation group running older software.
A pre-submission review found that the sub-set would not hold. Everyone shared the same Microsoft 365 tenant and the same file storage, the IT administrator accounts were common to all teams, and project staff regularly used the CAD workstations, which sat on the same network. Several directors and project staff read company email on personal phones that were not managed. The proposed boundary existed only as a list of names.
The consultancy weighed two options: build genuine separation, which would have required a separate tenant, separate administration and network redesign, or certify the whole organisation. The second proved simpler. It brought personal phones under a work profile policy with an option for staff to decline and use a company phone instead, moved the CAD software to a supported version after confirming compatibility with the vendor, isolated two legacy measurement machines on a network segment with no internet access, tightened administrator accounts, and listed eleven cloud services, three of which nobody in IT had known about.
The organisation certified as a whole about five weeks later than its original plan, but with a certificate that accurately described the business. At its next insurance renewal, it could answer the Cyber Essentials question without qualification, and the framework bid team could confirm that the systems handling public sector data were covered.
“We thought a sub-set would be the quick route. It turned out to be quicker to fix everything than to prove the sub-set was real. The certificate we ended up with actually means something, and nobody has to explain the small print.” — Operations Director, UK engineering consultancy
The lesson is not that sub-sets are always wrong. It is that a boundary has to exist in the network and the accounts, not just in the application, and that for most SMEs the whole organisation is the simplest boundary to defend.
Third parties, managed services and shared environments
Many SMEs rely on outside providers for some or all of their IT, and scope has to account for that.
Managed service providers
Devices and services managed by an IT provider on your behalf are still part of your organisation’s scope if they are used to access your data and services. The provider may carry out much of the work to meet the controls, but responsibility for the accuracy of your application stays with you. Make sure the provider supplies the information you need, such as device lists, patch status and administrator account details, and that their own administrative access to your systems is controlled.
Contractors and freelancers
Contractors who use their own devices to access your systems raise the same question as BYOD. If their devices access organisational data or services, they may need to be in scope, managed or prevented from accessing data. Providing contractors with managed company devices or controlled access routes is often simpler than bringing personally owned equipment into scope.
Shared offices and group companies
Serviced offices with shared networks, or group companies sharing infrastructure, complicate the boundary. If you rely on a landlord’s network, your devices’ own firewall controls become more important. If several companies in a group share a tenant, network or administrators, certifying one entity as a sub-set may be difficult without separation; certifying the group as a whole, or each entity with genuinely separate infrastructure, may be cleaner. The certificate identifies the legal entity it covers, so make sure the right one is named.
Remote and hybrid teams
Fully remote organisations, with no office network at all, still have a scope: every device staff use, every cloud service and every account. In these cases, device management and cloud configuration are effectively the whole of the certification. Our guide to remote workers and Cyber Essentials Plus covers the practical controls in more detail.
Keeping the scope current between certifications
Certification is renewed annually, but the business changes continuously. A scope that was accurate at certification can drift during the year as new staff, devices, services and offices arrive.
- New cloud services. A team signs up for a new platform holding customer data. It is now part of the real exposure and should meet the controls.
- Acquisitions and new entities. An acquired business with its own IT is not covered by your certificate until it is brought into scope or certified separately.
- New offices and sites. A new location may introduce new network equipment and devices.
- Changes in working practice. A shift to more home working or a new BYOD policy changes which devices are in scope.
- Changes to a sub-set boundary. New connections between in-scope and out-of-scope systems can quietly break the separation.
A simple discipline helps: whenever the business adds a significant system, site or way of working, ask whether it falls inside the certified boundary and whether it meets the controls. At renewal, start from a fresh look at how people work rather than copying last year’s scope. And whenever the certificate is mentioned in a tender, contract or insurance form, check that the scope still supports the claim being made.
At a glance: Cyber Essentials scope
| Area | General position | What to do |
|---|---|---|
| Whole organisation | Simplest and most credible scope for most SMEs | Default choice unless a genuine separation exists |
| Sub-set | Allowed with a genuine technical boundary | Demonstrate separation; describe the scope precisely |
| Company devices | In scope wherever they are used | Include home-based laptops and company phones |
| Personal devices | Generally in scope if they access organisational data or services | Manage them or block their access |
| Voice, text and MFA-only phones | Generally out of scope | Confirm against current wording |
| Cloud services | In scope if they hold or process organisational data | List every service; meet your share of the controls |
| Cloud-hosted servers | In scope | Patch, configure and control access as for on-premises servers |
| Home routers from an ISP | Generally out of scope | Apply firewall controls on the devices themselves |
| Organisation-supplied home routers | Generally in scope | Manage and update them |
| Unsupported systems | Must meet specific conditions to be excluded | Remove, replace or isolate as the requirements specify |
| Accounts | User and administrator accounts in scope | Include shared, service and third-party accounts |
| Managed services and contractors | Part of your scope if they access your data | Get the information you need; control their access |
| Scope description | Appears on the certificate | Write it so a customer would understand it correctly |
| Renewal | Annual | Re-map how people work; do not copy last year’s scope |
How Cloudswitched approaches Cyber Essentials scoping
We treat scope as the foundation of a Cyber Essentials engagement rather than a form field. Before any questionnaire is answered, we map how your people actually work — devices, locations, cloud services, accounts, contractors and providers — and build an inventory that reflects reality rather than the last asset register.
From there, we help you decide between whole-organisation and sub-set scope with the costs and implications laid out honestly. For most SMEs that leads to whole-organisation certification, and we then work through the remediation: bringing personal devices under management or controlling their access, configuring cloud services, tightening administrator accounts, and replacing or properly isolating unsupported systems. Where a sub-set is genuinely the right answer, we help design and evidence a boundary that will stand up to an assessor and write a scope description that customers and insurers will read correctly.
We also help keep scope current between certifications, flagging new services, sites and changes that affect the boundary, and preparing renewal from a fresh view of the business. Certification cannot remove every risk, but a scope that matches reality means the certificate genuinely reflects the systems your business depends on.
Want a certificate that matches your real business?
Talk to us about scoping, readiness and certification for Cyber Essentials and Cyber Essentials Plus.
Talk to a Cyber Essentials SpecialistFrequently Asked Questions
What is Cyber Essentials scope?
The defined part of your organisation covered by the certification: the devices, servers, network devices, cloud services and accounts that must meet the scheme’s technical controls. It can be the whole organisation or a sub-set, and it is described on the certificate.
Should we certify the whole organisation or a sub-set?
For most SMEs, the whole organisation is simplest and most credible. A sub-set can be appropriate where part of the organisation is genuinely separated by a technical boundary and there is a clear reason to certify only that part.
What does a sub-set need?
A technical boundary, typically a firewall or properly configured network segmentation, that separates in-scope systems from the rest of the organisation, together with a clear scope description. Shared accounts, tenants or devices across the boundary can undermine the separation.
Are personal devices in scope for Cyber Essentials?
Generally yes, if they access organisational data or services such as email, files or business applications. Devices used only for native voice calls, text messages or multi-factor authentication apps are generally out of scope. Check the current requirements for exact wording.
Are cloud services in scope?
Cloud services that hold or process organisational data are generally in scope and cannot be excluded. Responsibility for the controls is shared with the provider, depending on the type of service.
Are home workers’ routers in scope?
Home routers supplied by an internet provider for domestic use are generally out of scope, with firewall controls applied on the devices instead. Routers or firewalls supplied and managed by the organisation are generally in scope.
Can we exclude systems that would fail?
Only where they meet the conditions in the current requirements, typically by being genuinely isolated, for example in a segregated sub-set without internet access. Excluding connected, business-critical systems mainly to pass more easily leaves the risk in place and can misrepresent the business.
Does the scope appear on the certificate?
Yes. The certificate records whether the whole organisation is covered or describes the sub-set, which is why the description should be precise and understandable to customers.
What happens if our scope is wrong?
A certification body may query or reject an implausible scope, and for Cyber Essentials Plus the assessor checks consistency. After certification, a scope that does not match the business can cause problems with customer contracts and insurance if the certificate is relied on for systems it does not cover.
Does Cyber Essentials come with insurance?
Some certification packages have included cyber liability cover for eligible small organisations certifying their whole organisation. Eligibility and terms change, so check current details with your certification body and discuss your wider insurance needs with a broker.
Do contractors’ devices count?
If contractors use devices to access your organisational data or services, those devices may need to be in scope, managed or prevented from accessing data. Providing managed devices or controlled access is often simpler.
How often should we review scope?
At every annual renewal, starting from a fresh view of how people work, and whenever a significant change occurs, such as a new cloud service, office, acquisition or change in working practice.
Related reading
More guidance for UK businesses from the Cloudswitched blog:
- Internal versus external penetration testing
- Website security hardening: protecting your site from common attacks
- IT governance for UK SMEs: board reporting and risk registers
- Google Ads remarketing: building audience lists that convert
- Link building for UK businesses: earning backlinks without penalties
Draw the boundary where your business really is
Cloudswitched helps UK organisations scope Cyber Essentials accurately, close the gaps honestly and hold a certificate that customers and insurers can rely on.
Talk to a Cyber Essentials Specialist
Cloudswitched
London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.
