Sub-set
A sub-set is part of an organisation whose network is segregated from the rest of the organisation by a firewall or VLAN. A sub-set can define what is in or out of scope, and is the only way to keep unsupported software without failing A6.6, if it blocks all internet traffic. A2.2.2 rules out security groups and micro-segmentation.
- Term
- Sub-set
- Also known as
- Subset
- Category
- Scheme and certification
- Requirement area
- B. Definitions; D. Scope; 3. Security Update Management
- Reviewed against
- Requirements v3.3
What does the term sub-set mean in Cyber Essentials?
A sub-set is part of an organisation whose network is segregated from the rest of the organisation by a firewall or VLAN.
A sub-set is part of the organisation whose network is segregated from the rest of the organisation by a firewall or VLAN.
How does sub-set apply to Cyber Essentials?
In plain terms
A sub-set is a fenced-off part of your network. Think of a workshop with its own locked door and its own supply: what happens inside cannot spill into the main office. Businesses use one to keep a legacy machine that cannot be updated, a test lab, or a separately run department apart from everything else.
What are sub-sets used for?
Section B defines the term as quoted above, and it has two uses.
- Drawing a partial scope. Section D says "A sub-set can be used to define what is in scope or what is out of scope for your Cyber Essentials certification." You must justify the partial scope to the assessor, and the certificate then reads "Partial Organisation, see certificate platform for details" (A2.2 guidance).
- Keeping unsupported software. The security update management requirement allows unsupported software to be "removed from scope by using a defined sub-set that prevents all traffic to or from the internet". A6.7 asks how you have done this, and says that if the sub-set stays connected to the internet, "you will not be able to achieve whole company certification and you must select 'Partial Organisation' in question A2.1."
What counts as segregation?
| Method | Accepted? |
|---|---|
| A physical or virtual firewall between the sub-set and the rest of the network | Yes |
| A VLAN | Yes |
| Cloud security groups, micro-segmentation or other software-based methods | No, A2.2.2 says they "are not compliant" |
| The built-in Windows Firewall on each device | No, A2.5.1 says built-in firewalls "cannot be used to define the boundary of the scope" |
| A separate IP range with nothing filtering between them | No, there is no firewall or VLAN |
Which questions apply?
A2.2.1 describes any networks excluded by a sub-set, A2.2.2 describes how the sub-set was created (the guidance example is "Finance department - VLAN"), A2.5.1 lists the routers, physical firewalls or virtual firewalls that create it, and A6.7 describes how unsupported software has been moved into one.
Common mistakes
- Excluding a network but letting the same laptops reach it and the rest of the business. End-user devices that cross the boundary are still in scope.
- Trying to exclude a cloud service with a sub-set. Cloud services cannot be excluded from scope.
See the scope overview and the security update management requirements. Related: VLAN, network segregation, whole-organisation scope.
Related terms
- VLAN (virtual local area network)A VLAN, or virtual local area network, is a way of splitting one physical office network into separate networks that cannot talk to each other unless you allow it.
- Network segregationNetwork segregation is splitting a network into separate parts, so that devices in one part cannot freely reach devices in another.
- Whole-organisation scopeA whole-organisation scope means the Cyber Essentials assessment covers all the networks, user accounts and devices that access the organisation's data and services.
- Test caseA test case is one of five practical checks an assessor runs in a Cyber Essentials Plus audit, each with set pass and fail criteria.
- ApplicantAn applicant is the organisation seeking Cyber Essentials certification, or sometimes the individual acting as its main point of contact.
- AssessorAn assessor is the qualified person at a Certification Body who marks a Cyber Essentials self-assessment or carries out the Cyber Essentials Plus tests.
Frequently asked questions
A sub-set is part of an organisation whose network is segregated from the rest of the organisation by a firewall or VLAN. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, sub-set comes up at A2.2.1, A2.2.2, A2.5.1, A6.7. Read those questions against the definition above so your answers use the term the way the assessor will.
Sub-set relates to B. Definitions; D. Scope; 3. Security Update Management in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.