Organisational service
An organisational service is any software application, cloud application, cloud service, user interactive desktop or mobile device management system your organisation owns or subscribes to. In Cyber Essentials a user-owned device that reaches any organisational service is in scope under section D(i). Cloud-hosted services cannot be excluded, are listed at A2.9 and need MFA where available.
- Term
- Organisational service
- Category
- Scheme and certification
- Requirement area
- B. Definitions; D(i) BYOD
- Reviewed against
- Requirements v3.3
What does the term organisational service mean in Cyber Essentials?
An organisational service is any software application, cloud application, cloud service, user interactive desktop or mobile device management system your organisation owns or subscribes to.
Organisational service includes any software applications, cloud applications, cloud services, user interactive desktops and mobile device management (MDM) solutions that your organisation owns or subscribes to. For example: web applications, Microsoft 365, Google Workspace, mobile device management containers, Citrix Desktop, Virtual Desktop solutions or IP telephony.
How does organisational service apply to Cyber Essentials?
In plain terms
An organisational service is any system staff log in to for work: Microsoft 365 or Google Workspace, the accounting package, the CRM, a hosted phone system, a virtual desktop, or the device management console. If the organisation owns it or pays for it, and people use it to do their jobs, it counts.
How does it decide what is in scope?
Section B defines the term as quoted above. Together with organisational data, it decides whether a device is in scope: a user-owned device that reaches any organisational service is in scope under section D(i). The list is deliberately wide. A virtual desktop, an MDM container and an IP telephony platform all count, so a personal phone running a work softphone app is in scope even if it never opens email.
Cloud-hosted services carry a further rule: they "cannot be excluded from scope" and must be listed at A2.9. The A2.9 guidance adds that "Social media accounts (e.g. Facebook, LinkedIn, X) are also considered to be cloud services." A7.14 asks whether each service offers MFA, A7.15 lists any that do not, and where MFA is available A7.16 and A7.17 are automatic fails if any administrator or user is not covered.
A quick inventory method
- Export the list of enterprise applications or third-party sign-ins from your identity provider, such as Microsoft Entra ID or Google Workspace.
- Ask finance for every software subscription on the company card or invoices.
- Ask each team which logins they use that IT did not set up.
- Put every result at A2.9 and record whether MFA is on for admins and users.
Common mistakes
- Missing services bought on a personal card or a free tier, such as a file-sharing account used for one client.
- Forgetting the company social media accounts.
- Listing the service but not checking MFA on the separate admin login that some services keep outside single sign-on.
See BYOD scope and cloud services scope. Related: cloud service, SaaS, mobile device management.
Related terms
- Organisational dataOrganisational data is any electronic data belonging to your organisation, for example emails, documents, database data and financial data.
- Cloud serviceA cloud service is an on-demand, scalable service hosted on shared infrastructure, reached over the internet through an account, that stores or processes your organisation's data.
- SaaS (Software as a Service)Software as a Service (SaaS) is software you use over the internet through a subscription and a login, such as Microsoft 365 or Gmail, where the provider runs everything behind it.
- Mobile device management (MDM)Mobile device management is software that lets an organisation set up, secure and track its phones, tablets and laptops remotely from one console.
- PPN 014 (Procurement Policy Note 014)PPN 014 is the Cabinet Office procurement policy note that tells central government bodies to require Cyber Essentials from suppliers in relevant contracts.
- Question set versionsQuestion set versions are the named releases of the Cyber Essentials question set, which IASME updates when the NCSC revises the requirements.
Frequently asked questions
An organisational service is any software application, cloud application, cloud service, user interactive desktop or mobile device management system your organisation owns or subscribes to. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, organisational service comes up at A2.9, A5.4, A7.14. Read those questions against the definition above so your answers use the term the way the assessor will.
Organisational service relates to B. Definitions; D(i) BYOD in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.