Cloud service
A cloud service is an on-demand, scalable service hosted on shared infrastructure, reached over the internet through an account, that stores or processes your organisation's data. Under Cyber Essentials v3.3 cloud services cannot be excluded from scope. Each one is listed at A2.9 and needs MFA for administrators (A7.16) and users (A7.17), both automatic fails if answered No.
- Term
- Cloud service
- Category
- Malware, cloud and threats
- Requirement area
- B. Definitions; D(iv) Cloud services
- Reviewed against
- Requirements v3.3
What does the term cloud service mean in Cyber Essentials?
A cloud service is an on-demand, scalable service hosted on shared infrastructure, reached over the internet through an account, that stores or processes your organisation's data.
Cloud service means an on-demand, scalable service, hosted on shared infrastructure, and accessible via the internet. For the purposes of Cyber Essentials, a cloud service will be accessed via an account (which may be credentials issued by your organisation, or an email address used for business purposes), and will store or process data for your organisation.
How does cloud service apply to Cyber Essentials?
In plain terms
If your staff sign in to it through a web browser or app, it runs on someone else's servers, and it holds your organisation's data, it is a cloud service. Email, file storage, accounting software, CRM, HR systems, video calls and your company social media accounts all count.
What Cyber Essentials asks
Requirements v3.3 added the formal definition quoted above, and the scope section states that cloud services cannot be excluded. The requirements recognise three types:
| Type | What you rent | Examples in the requirements |
|---|---|---|
| IaaS | Virtual servers and networks you configure and manage | Rackspace, Google Compute Engine, Amazon EC2 |
| PaaS | A platform you build and run applications on | Azure Web Apps, Amazon Web Services Lambda |
| SaaS | A finished application you configure | Microsoft 365, Dropbox, Gmail |
The A2.9 guidance adds that "Social media accounts (e.g. Facebook, LinkedIn, X) are also considered to be cloud services."
The questions that follow:
- A2.9: list every cloud service your organisation uses.
- A7.14: does every service offer MFA?
- A7.15: list any that offer no MFA option at all. Listing one that does offer MFA is an automatic fail.
- A7.16 and A7.17: MFA applied to all administrators and all users. A No to either is an automatic fail. The A7.16 guidance pairs MFA with "a password of at least 8 characters".
How to build the list
Start from what you pay for, then add free services staff sign in to with a work email address. Check the single sign-on app list in your identity provider, the expenses log and the browser extensions people use. For each one, note the admin accounts and where MFA is switched on.
Common mistakes
- Leaving out free tools and social media accounts.
- A shared login for a service, which also breaks the unique credentials rule at A7.2.
See cloud services scope and A7.16. Related: cloud tenant, identity provider, multi-factor authentication.
Related terms
- IaaS (Infrastructure as a Service)Infrastructure as a Service (IaaS) is renting virtual servers and networks from a cloud provider, which your organisation then sets up and looks after much as it would physical equipment.
- PaaS (Platform as a Service)Platform as a Service (PaaS) is a cloud service where the provider runs the servers underneath and your organisation supplies and manages its own applications.
- SaaS (Software as a Service)Software as a Service (SaaS) is software you use over the internet through a subscription and a login, such as Microsoft 365 or Gmail, where the provider runs everything behind it.
- Cloud tenantA cloud tenant is your organisation's own private space inside a shared cloud service, such as your Microsoft 365 or Google Workspace setup, with its own users, settings and data.
- Identity provider (IdP)An identity provider is the service that checks who you are when you sign in and then vouches for you to other apps, for example Microsoft Entra ID, Google Workspace or Okta.
- Multi-factor authentication (MFA)Multi-factor authentication (MFA) is a method of authenticating a user which uses two or more verification factors.
Frequently asked questions
A cloud service is an on-demand, scalable service hosted on shared infrastructure, reached over the internet through an account, that stores or processes your organisation's data. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, cloud service comes up at A2.9, A7.14, A7.15, A7.16, A7.17. Read those questions against the definition above so your answers use the term the way the assessor will.
Cloud service relates to B. Definitions; D(iv) Cloud services in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.