Whole-organisation scope
A whole-organisation scope means the Cyber Essentials assessment covers all the networks, user accounts and devices that access the organisation's data and services. You choose it at A2.1; the alternative is a partial scope built from a segregated sub-set. The NCSC says it gives the best protection, and IASME's included cyber insurance needs it.
- Term
- Whole-organisation scope
- Also known as
- whole organisation, full scope, whole company certification
- Category
- Scheme and certification
- Requirement area
- D. Scope
- Reviewed against
- Requirements v3.3
What does the term whole-organisation scope mean in Cyber Essentials?
A whole-organisation scope means the Cyber Essentials assessment covers all the networks, user accounts and devices that access the organisation's data and services.
Please note: Organisations that choose a scope which includes their whole IT infrastructure achieve the best protection and maximise their customers' confidence.
How does whole-organisation scope apply to Cyber Essentials?
In plain terms. It is the difference between surveying the whole house and surveying only the extension. With a whole-organisation scope, nothing that touches your business data is left out, so the certificate means what customers assume it means.
What Cyber Essentials asks. A2.1 asks: "Is this assessment for your whole organisation or only a part of it?" The guidance says the whole organisation "includes all networks, user accounts and devices which access your organisation's data and services". A partial scope excludes networks, and that "must be done using a firewall or VLAN". Whichever you choose, cloud services cannot be excluded and a scope without end-user devices is not acceptable. A6.7 adds a consequence: if unsupported software sits on a sub-set that is still connected to the internet, "you will not be able to achieve whole company certification" and must select Partial Organisation.
Why it matters for insurance. IASME's cyber liability insurance page says the cover applies "When a UK-domiciled organisation with a turnover under £20m achieves self-assessed certification covering their whole organisation". A3.1 asks the domicile and turnover question, and A3.2 asks whether you opt in. A partial scope does not qualify.
What an assessor looks for. Consistency. A whole-organisation answer at A2.1 should match every network at A2.4, all the equipment and devices at A2.5 to A2.8 and every cloud service at A2.9. If a legacy machine or a forgotten office network does not meet the controls, the whole-organisation claim fails with it.
See scope, the scope requirements and the scope checklist.
Related terms
- Sub-setA sub-set is part of an organisation whose network is segregated from the rest of the organisation by a firewall or VLAN.
- ScopeScope is the networks, hardware and software assets, and cloud services that are included in a Cyber Essentials assessment.
- ApplicantAn applicant is the organisation seeking Cyber Essentials certification, or sometimes the individual acting as its main point of contact.
- AssessorAn assessor is the qualified person at a Certification Body who marks a Cyber Essentials self-assessment or carries out the Cyber Essentials Plus tests.
- Board declarationThe board declaration is the confirmation, given by a director or board-level person, that every answer in a Cyber Essentials self-assessment is accurate.
- Certificate expiryCertificate expiry is the date, 12 months after issue, when a Cyber Essentials certificate stops being current.
Frequently asked questions
A whole-organisation scope means the Cyber Essentials assessment covers all the networks, user accounts and devices that access the organisation's data and services. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, whole-organisation scope comes up at A2.1, A2.2, A6.7. Read those questions against the definition above so your answers use the term the way the assessor will.
Whole-organisation scope relates to D. Scope in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.