Organisational data
Organisational data is any electronic data belonging to your organisation, for example emails, documents, database data and financial data. In Cyber Essentials it decides scope: a user-owned device that accesses organisational data or services is in scope. A personal phone that reads work email is in; one used only for calls, texts or an MFA app is not.
- Term
- Organisational data
- Category
- Scheme and certification
- Requirement area
- B. Definitions; D(i) BYOD
- Reviewed against
- Requirements v3.3
What does the term organisational data mean in Cyber Essentials?
Organisational data is any electronic data belonging to your organisation, for example emails, documents, database data and financial data.
Organisational data includes any electronic data belonging to your organisation, for example, emails, documents, database data, financial data.
How does organisational data apply to Cyber Essentials?
In plain terms
Organisational data is anything electronic that belongs to the business: the email in a shared inbox, the quote saved in OneDrive, the customer list in the CRM, the payroll export on a finance laptop. If losing it or leaking it would be the organisation's problem, it is organisational data.
How does it decide what is in scope?
Section B defines the term as quoted above, and it is the trigger for scope. Section D(i) says user-owned devices "which access organisational data or services (as defined above) are in scope", and the secure configuration requirement says you must "ensure users are authenticated before allowing them access to organisational data or services."
The requirements make one carve-out. Mobile or remote devices used only for "native voice applications", "native text applications" or "multi-factor authentication (MFA) applications" are out of scope.
| Device and use | In scope? |
|---|---|
| Company laptop used for email and files | Yes |
| Personal phone with the Outlook app for work email | Yes, it reaches organisational data |
| Personal phone used only for work calls and texts | No, native voice and text only |
| Personal phone used only for the Microsoft Authenticator app | No, MFA app only |
| Home PC used to open the company webmail in a browser | Yes |
What an assessor looks for
- Every device that reaches work data listed at A2.6 or A2.8, including BYOD. The A2.6 guidance says it "applies to both your corporate and user owned devices (BYOD)".
- A consistent story. If staff read email on their own phones, those phones should appear in the device list and meet the controls.
Common mistakes
- Leaving personal phones off the list because the business did not buy them.
- Assuming a browser-only login does not count. The test is access to the data, not whether an app is installed.
The companion term is organisational service, which covers the applications and cloud services through which the data is reached. The NCSC suggests "Using the organisational data and services definitions to enforce strong access policies", for example by allowing access only from devices that meet a compliance policy.
See BYOD scope and the secure configuration requirements. Related: BYOD, end-user device.
Related terms
- Organisational serviceAn organisational service is any software application, cloud application, cloud service, user interactive desktop or mobile device management system your organisation owns or subscribes to.
- BYOD (bring your own device)BYOD, short for bring your own device, means staff using their own personal phones, tablets or computers to do work.
- End-user device (EUD)An end-user device is any computer, tablet, phone or thin client that a person uses directly to do their work.
- PPN 014 (Procurement Policy Note 014)PPN 014 is the Cabinet Office procurement policy note that tells central government bodies to require Cyber Essentials from suppliers in relevant contracts.
- Question set versionsQuestion set versions are the named releases of the Cyber Essentials question set, which IASME updates when the NCSC revises the requirements.
- Re-markA re-mark is a second marking of a failed Cyber Essentials self-assessment after the applicant has corrected the answers.
Frequently asked questions
Organisational data is any electronic data belonging to your organisation, for example emails, documents, database data and financial data. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, organisational data comes up at A2.8, A5.4. Read those questions against the definition above so your answers use the term the way the assessor will.
Organisational data relates to B. Definitions; D(i) BYOD in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.