Scope
Scope is the networks, hardware and software assets, and cloud services that are included in a Cyber Essentials assessment. It should cover the whole IT infrastructure or a separately managed sub-set, agreed with the Certification Body before assessment. A scope without end-user devices is not acceptable, and cloud services cannot be excluded. A2.1 asks whether it is whole or partial.
- Term
- Scope
- Also known as
- Certification scope
- Category
- Scheme and certification
- Requirement area
- B. Definitions; D. Scope
- Reviewed against
- Requirements v3.3
What does the term scope mean in Cyber Essentials?
Scope is the networks, hardware and software assets, and cloud services that are included in a Cyber Essentials assessment.
Scope means the networks, hardware and software assets, and cloud services that are included in the assessment.
How does scope apply to Cyber Essentials?
In plain terms
Scope is the boundary line around what the certificate covers. Everything inside the line has to meet all five controls, and the certificate tells customers what was checked. Draw it too narrowly and the certificate says little; draw it accurately and it reflects how the business actually works.
What do the requirements say?
Section B defines the term as quoted above, and section D expands it. Your certification "should cover the whole of the IT infrastructure used to carry out your organisation’s business, or if necessary, a well-defined and separately managed sub-set". You define the boundary by "the business unit managing it, the network boundary and physical location" and agree it with your Certification Body before assessment begins. Whole-organisation scope "achieve[s] the best protection and maximise[s] their customers' confidence", and a partial scope must be justified to the assessor.
Two hard rules apply: "A scope that doesn’t include end-user devices isn’t acceptable" and "Cloud services cannot be excluded from scope." The requirements cover devices and software that can accept incoming connections from internet-connected devices, can establish outbound connections via the internet, or control the flow of data between those devices and the internet.
Is it in scope? A quick decision table
| Item | In scope? | Where the rule comes from |
|---|---|---|
| Company laptops, desktops, phones and tablets that reach the internet | Yes | Section D, A2.6 and A2.8 |
| Personal phones or PCs that reach work email, files or apps | Yes | D(i) BYOD |
| Personal phones used only for calls, texts or an MFA app | No | D(i) BYOD |
| Every cloud service, including social media accounts | Yes, cannot be excluded | D(iv), A2.9 |
| A router you give a home worker | Yes | D(ii) home and remote working |
| A home worker's own broadband router | No, use software firewalls on their devices instead | D(ii) |
| Wireless access points that can communicate via the internet | Yes | D(iii) wireless devices |
| Development, testing and penetration testing networks | No, keep them separated by a firewall or VLAN | A2.4 guidance |
| Bespoke and custom components of web applications you build | No, though publicly available commercial web applications are in scope by default | D(vii) software development |
Which questions set the scope?
A2.1 asks whether the assessment is whole or partial; A2.2 describes a partial scope; A2.2.1 and A2.2.2 describe any sub-set used to exclude networks; A2.4 lists the in-scope networks; A2.4.1 and A2.4.2 cover home workers; A2.5 to A2.8 list equipment and devices; and A2.9 lists every cloud service.
Common mistakes
- Choosing a partial scope to leave out an awkward device, then finding the same staff laptops reach both sides.
- Missing BYOD phones that read work email.
- Leaving a small cloud service off A2.9, such as a payroll portal or a file-sharing account.
See the scope overview and the scope checklist. Related: whole-organisation scope, BYOD, cloud service.
Related terms
- Sub-setA sub-set is part of an organisation whose network is segregated from the rest of the organisation by a firewall or VLAN.
- Whole-organisation scopeA whole-organisation scope means the Cyber Essentials assessment covers all the networks, user accounts and devices that access the organisation's data and services.
- BYOD (bring your own device)BYOD, short for bring your own device, means staff using their own personal phones, tablets or computers to do work.
- Cloud serviceA cloud service is an on-demand, scalable service hosted on shared infrastructure, reached over the internet through an account, that stores or processes your organisation's data.
- Self-assessment questionnaireThe self-assessment questionnaire is the set of written questions an organisation answers about its own IT to apply for Cyber Essentials.
- Test caseA test case is one of five practical checks an assessor runs in a Cyber Essentials Plus audit, each with set pass and fail criteria.
Frequently asked questions
Scope is the networks, hardware and software assets, and cloud services that are included in a Cyber Essentials assessment. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, scope comes up at A2.1, A2.2, A2.4, A2.9. Read those questions against the definition above so your answers use the term the way the assessor will.
Scope relates to B. Definitions; D. Scope in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.