What is in scope for Cyber Essentials?
Everything your organisation uses to do its business is in scope, unless you deliberately exclude part of it with a technically separated sub-set. The NCSC’s requirements apply to every device and piece of software in scope that can accept connections from the internet, make outbound connections over it, or control the flow of data between the two. A scope without end-user devices is not acceptable, and you agree your scope with your certification body before the assessment starts. Everything inside it must then meet the five Cyber Essentials controls.
| Item | In scope? | Conditions |
|---|---|---|
| Office and home workers’ devices | Yes | Company-owned devices used for your business, wherever staff work. A router you give a home worker is in scope; their own broadband router is not. |
| Personal devices (BYOD) | Yes, if they access organisational data or services | Staff, volunteer and trustee-owned phones, tablets and computers that open work email, files or business apps. Devices used only for calls, texts or an MFA app are out of scope. |
| Cloud services | Always | Microsoft 365, Google Workspace, AWS, Azure and any other cloud service that holds or processes your data. They can never be excluded, and MFA is required wherever it is offered. The NCSC’s shared responsibility table splits the controls by service type: with IaaS you configure the servers and operating systems yourself, with PaaS and SaaS the provider covers more, but user access control, including MFA, always stays with you. |
| Servers | Yes | Physical and virtual servers that provide data or services, on premises or hosted, including cloud servers you configure yourself. |
| Thin clients | Yes | The NCSC lists them as end-user devices, so they need a supported, updated operating system and a secure configuration like any laptop. |
| Network devices | Yes, at the internet boundary | Firewalls and routers between your networks and the internet. Wireless access points are in scope only if they can communicate with other devices via the internet. |
| Devices owned by your MSP, contractors or customers | No | The accounts you give them are in scope, and you remain responsible for checking that their devices are configured correctly. |
Source: the NCSC’s Cyber Essentials Requirements for IT Infrastructure v3.3 (April 2026). IASME’s guidance article on Cyber Essentials scope covers the same ground with worked examples.
Can you certify part of your organisation (sub-set scope)?
Yes, if the part you certify is technically separated. The NCSC defines a sub-set as part of the organisation whose network is segregated from the rest by a firewall or VLAN, and you must be able to name the business unit that manages it, its network boundary and its physical locations. IASME’s Danzell question set adds that security groups, microsegmentation and other software-based methods do not count. A department that shares the main office network has no technical boundary, so it cannot be certified on its own.
Common reasons for a sub-set are keeping unsupported systems out of scope (they must sit in a sub-set that blocks all traffic to and from the internet), certifying a UK operation separately from an overseas group, or excluding an isolated production network. Development, test and penetration testing networks should also be kept out of scope behind a firewall or VLAN. Weigh up the costs first: you have to justify the partial scope to your assessor, cloud services stay in scope whatever you exclude, the part you certify must include its staff devices, and the cyber insurance IASME includes for eligible organisations only applies when the whole organisation is certified. A partial certificate also reads “Partial Organisation”, which may not satisfy a contract that expects the whole business to be covered.
Are home workers and BYOD in scope? (Cyber Essentials BYOD rules)
Yes. The NCSC’s default is that every company-owned or personal device used for your organisation’s business at home or on the move is in scope, and IASME counts anyone who works from home for any amount of time as a home worker, so hybrid and remote workers are covered too. Personal devices (BYOD) are in scope when they access organisational data or services, such as email, Teams, shared files or a business app.
For home workers, the router decides where the firewall control sits. A router you supply must meet the firewall rules. The worker’s own broadband router is out of scope, so each device needs its software firewall switched on, or a corporate VPN that puts the boundary on your company firewall. For personal devices, either bring them up to the controls (a supported operating system, updates within 14 days, a screen lock and MFA on cloud accounts) or block them from company data. Our guide to Cyber Essentials mobile device requirements covers phones and tablets in detail.
Is Cyber Essentials Plus scope the same?
Yes. Cyber Essentials Plus audits the scope on your Cyber Essentials certificate, which must have been issued in the previous three months. The assessor then tests a sample of devices from that scope, chosen per operating system version using the sample sizes beside the form above. If anything changes between the two stages, such as a new office, a new cloud service or a different mix of devices, tell your certification body before the audit, because your asset declaration must match the scope you certified. Our Cyber Essentials Plus requirements page explains the tests.
Cyber Essentials scope examples: what does a good scope statement look like?
A clear scope statement names the legal entity, the locations, the device types with their operating systems, the cloud services and anything excluded. Two examples, with placeholders in square brackets:
- Whole organisation: “[Organisation name] Ltd (company number [number]): head office in [town], 40 Dell laptops running Windows 11 Pro version 25H2, 2 Windows Server 2022 virtual servers, 35 Apple iPhones on a supported iOS version (company and personal) used for work email, home workers’ devices, and the Microsoft 365, Xero and AWS services used by the business.”
- Sub-set: “[Organisation name] Ltd, UK operation only: the [town] office network, separated by firewall from the group network, with 25 laptops running Windows 11 Pro version 25H2, 12 Apple iPhones, 1 Windows Server 2022 virtual server, home workers’ devices and the Microsoft 365 tenant. Excluded: the production line control network, which has no internet access.”
The Danzell question set used since April 2026 asks for the make and operating system version of every device type (including the Windows edition and feature version), the make and model of each firewall and router, every legal entity covered and a description of any excluded networks. Our Cyber Essentials questionnaire page shows what each section asks.
What happens after you send this questionnaire?
An assessor at Sovereign Secure, an IASME-licensed Cyber Essentials certification body, reviews your answers, confirms your scope with you and aims to send a fixed quote for Cyber Essentials or Cyber Essentials Plus within one working day. If you only need basic Cyber Essentials, our Cyber Essentials prices are published in full, from £320 + VAT. Still checking whether a customer really requires it? Our FAQs answer do I need Cyber Essentials and what the scheme involves.