Checklist · scope under v3.3

Cyber Essentials scope checklist

What is in and out of scope for Cyber Essentials under Requirements v3.3: whole organisation or sub-set, end user devices, cloud services, BYOD, home working, wireless, third-party accounts and devices.

View as Markdown

Updated 22 September 2026

Short answer

Cyber Essentials scope under v3.3 covers every network, device, software asset and cloud service used for the organisation's business, either as a whole organisation or a sub-set segregated by a firewall or VLAN. End user devices and cloud services cannot be excluded. BYOD, home workers and accounts used by suppliers or MSPs are in scope.

Key facts

Rows: 17 requirements in 7 sections
Sections: Boundary, Devices, Cloud, BYOD and remote, Wireless, Third parties, Software
Questions mapped: 24 Danzell questions
Scheme version: Requirements v3.3 (April 2026)

How do you use this checklist?

Scope decisions come before every other control, because every requirement applies only to what you put in scope. Work through each row and record the answer you will give in section A2 of the question set.

The question column links to the Danzell question that covers the row. Questions marked auto-fail end the assessment on their own if answered no (A7.15 only if a service listed there does offer MFA), so clear those first. Tick the done column as you go, or print the page to work through it on paper.

What is on the Cyber Essentials scope checklist?

17 rows across 7 sections: each row gives the requirement, the evidence to gather and the Danzell question that asks about it, with a column to tick when it is done.

Done	Requirement	Evidence to gather	Question
1Boundary3 rows
	The assessment covers the whole IT infrastructure, or a well-defined and separately managed sub-set. The NCSC says whole-organisation scope gives the best protection and maximises customer confidence.	Evidence to gatherScope decision recorded with the reason for any partial scope, which you must justify to the assessor.	A2.1 A2.2
	A sub-set is segregated from the rest of the organisation by a firewall or VLAN, and the business unit, network boundary and physical location are stated. The A2.2.2 guidance says security groups, microsegmentation and other software-based methods are not compliant.	Evidence to gatherNetwork diagram and the firewall or VLAN configuration that creates the boundary. A description in the form the guidance gives, for example 'Finance department, VLAN'.	A2.2.1 A2.2.2 A2.5.1
	Every site with in-scope networks has its internet connection described, or the way sites are connected is explained. Each in-scope network is listed by name, location and purpose.	Evidence to gatherSite list with internet connection type and any site-to-site links. Network list such as 'Main network at head office for administrative use'. Do not include IP addresses, and leave development, testing and penetration-testing networks off the A2.4 list, as its guidance instructs.	A2.3 A2.3.1 A2.3.2 A2.4
2Devices3 rows
	End user devices that access organisational data or services are in scope. A scope that excludes end user devices is not acceptable.	Evidence to gatherDevice inventory with quantities and operating system versions for laptops, desktops, virtual desktops, thin clients, tablets and phones.	A2.6 A2.6.1 A2.8
	Servers, virtual servers, hypervisors and IaaS instances are in scope and listed with their operating systems.	Evidence to gatherServer inventory including virtual hosts and cloud instances.	A2.7
	Network equipment that controls the flow of data to and from the internet (firewalls and routers) is listed, including devices that create a sub-set boundary. Switches and access points without a firewall or internet routing are not required.	Evidence to gatherNetwork equipment inventory with make, model, quantity and firmware version.	A2.4 A2.5 A2.5.1
3Cloud1 row
	Every cloud service that hosts organisational data or services (IaaS, PaaS, SaaS) is in scope, including social media accounts. Cloud services cannot be excluded.	Evidence to gatherList of cloud services with provider and service type, and where the provider implements a control on your behalf, the contract or trust centre document that commits them to it.	A2.9
4BYOD and remote4 rows
	User-owned devices that access organisational data or services are in scope, unless used only for native voice calls, native text messages or MFA applications.	Evidence to gatherBYOD count in the device inventory and the policy that governs which devices may connect.	A2.6 A2.8
	All corporate and BYOD home or remote working devices used for the organisation's business are in scope. The A2.4.1 guidance counts any employee given permission to work remotely, for any period, as a home or remote worker.	Evidence to gatherNumber of home and remote workers and how they reach organisational data (home router, business-provided router or corporate VPN).	A2.4.1 A2.4.2
	A router the organisation gives to a home worker is in scope. Other home routers are out of scope, so firewall controls apply on the device itself.	Evidence to gatherRecord of organisation-supplied home routers and how they meet the firewall control. Host firewall policy for remote devices. The A2.5 guidance says routers and firewalls in the home environment are not listed in A2.5 itself.	A2.5 A4.1.1
	Where remote workers use a corporate VPN, the internet boundary is the company firewall or the virtual or cloud firewall.	Evidence to gatherVPN configuration showing traffic routes through the corporate boundary.	A2.4.2 A4.1
5Wireless1 row
	Wireless devices and access points are in scope if they can communicate with other devices via the internet, and out of scope if an attacker could only reach them within signal range or they are part of an ISP router at a home location.	Evidence to gatherAccess point inventory with a note of which are internet-reachable.	A2.5
6Third parties3 rows
	All accounts the organisation owns are in scope, including accounts used by suppliers, contractors and MSPs to manage or support the infrastructure.	Evidence to gatherThird-party and MSP account register and confirmation that the technical controls are met on their access.	A2.10 A7.2 A7.8
	End user devices the organisation owns and loans to a third party are in scope.	Evidence to gatherLoaned device list in the inventory.	A2.6
	Third-party-owned devices used by employees, volunteers, trustees and university research assistants (BYOD) are in scope. Devices owned by students, MSP administrators, third-party contractors and customers are out of scope.	Evidence to gatherRole-based device table showing which third-party devices are in and out, and how out-of-scope devices are still checked before connecting.	A2.6 A2.8
7Software2 rows
	Publicly available commercial web applications are in scope by default. Bespoke and custom components of web applications are out of scope.	Evidence to gatherList of commercial web applications in use and a note of any in-house development.	A2.9
	Unsupported software is removed, or the devices running it are moved into a sub-set that prevents all traffic to and from the internet.	Evidence to gatherSub-set design and firewall rules for any isolated legacy devices.	A6.6 A6.7

What evidence does the assessor expect?

For the self-assessment, the assessor reads the notes field under each question and decides whether the wording describes a control that meets the requirement. Vague answers get a query, and unanswered queries become a fail. The evidence column above tells you what to have to hand so that every notes field can be specific: the policy name, the setting, the number of devices it applies to and the date it was checked.

For Cyber Essentials Plus, the assessor does not rely on the notes. They scan the sampled devices, send test files, watch a user log in to each cloud service and try to run an administrative task as a standard user. The same evidence still matters, because it is how you confirm the controls are in place before the audit rather than during it.

How assessors check this

Assessors compare A2.6 to A2.9 against every other answer. If A2.6 lists 30 Windows 11 laptops and A6.2.1 lists a browser version that only runs on Windows 10, the inconsistency is queried. Build the inventory once, from a single export, and use it for every question that asks for quantities or versions.

Common failure

The scope says whole organisation, but the cloud services list at A2.9 omits a SaaS system that holds customer data because the finance team set it up without IT. The assessor finds it referenced elsewhere in the answers, and the missing service has no MFA enforced, which then fails A7.17. Ask every department for their logins before you submit.

Frequently asked questions

Only by defining a sub-set that is segregated from the rest of the network by a firewall or VLAN, and only if the remaining scope still includes end user devices. A scope that excludes all end user devices is not acceptable under v3.3, and you must justify any partial scope to the assessor.

Yes if they access organisational data or services, for example email or Teams. A personal phone used only for native voice calls, native text messages or as an MFA authenticator is out of scope.

No. Devices owned by an MSP administrator, a third-party contractor or a customer are out of scope under Table 2 of v3.3. The accounts your MSP uses on your systems are in scope, and you must be able to show the technical controls are met on that access.

Yes. Cloud services cannot be excluded. The applicant is always responsible for ensuring the controls are implemented, although for IaaS, PaaS and SaaS some controls are implemented by the provider. Where that is the case you must be able to point to a contractual commitment or a trust centre document.

A3.1 sets the eligibility test for the included cyber insurance: a head office domiciled in the UK or Crown Dependencies and gross annual turnover under £20m. A3.2 then asks you to opt in, at no additional cost. The question set does not say how a sub-set scope affects the cover, so if you are certifying part of the organisation, confirm eligibility with your Certification Body before you rely on it.

A member of your own organisation. The A2.10 guidance says the person responsible for managing your IT systems in scope cannot be someone employed by your outsourced IT provider. Name the internal owner, such as the operations director, even if an MSP does the day-to-day work.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readiness Book a gap analysis, from £500

IASME Certification Body
CREST accredited
IASME fee included
UK offices in Leeds, Newcastle, London and Edinburgh

Sources

How do you use this checklist?

What is on the Cyber Essentials scope checklist?

1Boundary3 rows

2Devices3 rows

3Cloud1 row

4BYOD and remote4 rows

5Wireless1 row

6Third parties3 rows

7Software2 rows

What evidence does the assessor expect?

Related pages

Frequently asked questions

Can I exclude some laptops from scope?

Are personal phones in scope?

Is my MSP's laptop in scope?

Do cloud services count if the provider manages security?

Does the included insurance depend on scope?

Who should be named as responsible for IT in A2.10?

Would you pass the 2026 question set?