A1.6: Does your scope include more than one legal entity?
Do you have more than one legal entity, including subsidiaries, within the scope of this assessment?
Source: IASME Cyber Essentials Danzell question set v16.3
Answer Yes to A1.6 only if other legal entities, such as subsidiaries, are in the same scope and share the same IT infrastructure, network and signatory. Each is then listed in A1.6.1 and appears on your certificate. Entities that do not share infrastructure or a signatory need their own assessments, and entities left out of A1.6.1 cannot be added later.
Is A1.6 an automatic fail?
No. A1.6 records information about your organisation and is not marked against a technical requirement, so no answer to it fails the assessment. Inaccurate or contradictory details may be returned by the assessor for correction.
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- 1. - All additional legal entities must share the same IT infrastructure and network.
- Logic
- If answered no proceed to Q A1.7 If answered Yes proceed to Q A1.6.1
- Requirement enforced
- Section A1 collects the details that appear on the certificate and shape which later questions are shown.
- Outcome if non-compliant
- Not marked against a requirement; inaccurate details may be returned for correction
What does A1.6 ask?
A1.6 asks: “Do you have more than one legal entity, including subsidiaries, within the scope of this assessment?”
A1.6 asks whether you have more than one legal entity, including subsidiaries, within the scope of this assessment. If you do, you must answer Yes and add each entity in A1.6.1.
IASME's conditions are explicit. All additional legal entities must share the same IT infrastructure and network. The board member signing off must have authority to represent all the listed entities. Any entity not listed in A1.6.1 cannot be added after the certification process is complete.
Separate assessments are required where the entities have different legally responsible persons, different network infrastructure, or are separate companies with no shared governance or oversight.
How should you answer A1.6?
A1.6 has no single compliant answer. Answer it accurately for your organisation today; this is what each answer means.
- Answer Yes if one or more other legal entities use the same IT infrastructure and network as the entity in A1.1 and are meant to be covered by this certificate.
- Answer Yes only if the person signing off the assessment can legally represent every listed entity.
- Answer No if the entity in A1.1 is the only one in scope, or if a sister company has its own network or its own directors; that company needs its own assessment.
- Decide before you submit: entities not listed in A1.6.1 cannot be added once the certificate is issued.
What mistakes do applicants make with A1.6?
A common mistake with A1.6: answering No and then naming several companies in A1.1, which is returned for correction.
- Including a sister company that runs its own network or IT provider, which the guidance says needs a separate assessment.
- Forgetting a subsidiary that a customer contract names, then finding it cannot be added after certification.
- A signatory who is a director of the parent but has no authority over a listed subsidiary.
How do you get A1.6 right?
Work through these steps before you enter A1.6 in the portal:
- List every legal entity you want the certificate to cover.
- Check each one shares the same IT infrastructure and network, and that the signatory can legally represent all of them.
- Answer Yes and add each qualifying entity in A1.6.1; plan a separate assessment for any entity with its own network, IT management or board.
- Decide before you submit, because entities left out cannot be added after certification.
How do assessors check A1.6?
What evidence should you keep for A1.6?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A1.6:
- A note of each entity's register entry, the shared infrastructure and the signatory's authority over each.
Where to go next
- Whole organisation scopeGlossary
- ScopeGlossary
- How to get certifiedThe application, step by step
- What Cyber Essentials costsIASME fee bands and assessor prices
- All A1 questionsYour organisation
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A1 questions
- A1.5A1.5NotesWhat is your organisation's registered address?Notes
- A1.5.1A1.5.1NotesPlease provide the operational addresses, if different to your registered address.Notes
- A1.6.1A1.6.1Multiple choice + notesPlease provide the name, company number and registered address of any additional legal entities that are included.Multiple choice + notes
- A1.7A1.7Multiple choice + notesWhat is your main business?Multiple choice + notes
Frequently asked questions
A1.6 in the 2026 Danzell Cyber Essentials question set asks: "Do you have more than one legal entity, including subsidiaries, within the scope of this assessment?" It is a Yes/No question.
Answer Yes to A1.6 only if other legal entities, such as subsidiaries, are in the same scope and share the same IT infrastructure, network and signatory. Each is then listed in A1.6.1 and appears on your certificate. Entities that do not share infrastructure or a signatory need their own assessments, and entities left out of A1.6.1 cannot be added later.
No. A1.6 records information about your organisation and is not marked against a technical requirement, so no answer to it fails the assessment. Inaccurate or contradictory details may be returned by the assessor for correction.
Yes, if they share the same IT infrastructure and network and one board member can sign off for all of them. List each in A1.6.1. Each included entity appears on the primary entity's certificate and shares its expiry date.
No. IASME's A1.6 guidance says any legal entity not listed in A1.6.1 cannot be added after the certification process is complete. It would need its own assessment.
When it has a different legally responsible person, different network infrastructure, or no shared governance or oversight with the primary entity, according to IASME's A1.6 guidance.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh