Cyber Essentials A2 questions: scope of assessment
The A2 questions define what is being assessed: whole or partial organisation, sub-sets, sites, networks, remote workers and the full inventory of devices and cloud services.
Section A2 is the scope inventory. It asks whether the assessment covers the whole organisation, describes any sub-sets, and lists networks, network equipment, computers, thin clients, servers, mobile devices and every cloud service. Accurate counts and operating system versions here decide whether the control answers can be believed.
- Questions
- 18 (A2.1 to A2.10)
- Auto-fails
- None
- Control
- Not a technical control
- CE Plus test
- No dedicated test case in the CE Plus specification v3.2
What questions are in section A2?
Section A2 has 18 questions, A2.1 to A2.10, none of them automatic fails. Each page gives the exact wording, what a compliant answer looks like and a model answer.
- A2.1A2.1Multiple choiceIs this assessment for your whole organisation or only a part of it?Multiple choice
- A2.2A2.2NotesIf you are certifying part of your organisation, please write a detailed description of the scope here.Conditional: if 'partial organisation' has been selected in A2.1Notes
- A2.2.1A2.2.1NotesPlease provide a description of any networks that have been excluded from the assessment by creating a sub-set.Conditional: if 'partial' in A2.1Notes
- A2.2.2A2.2.2NotesWhere one or more sub-sets have been created, please describe how this has been achieved.Notes
- A2.3A2.3NotesAre the networks included in the scope of this assessment being used at the company locations you provided earlier?Notes
- A2.3.1A2.3.1Yes/NoDo you have an internet connection for each site in your organisation?Yes/No
- A2.3.2A2.3.2NotesIf no, please describe the way that your sites are connected.Conditional: if no to A2.3.1Notes
- A2.4A2.4NotesPlease provide a list of networks that will be in scope for this assessment.Notes
- A2.4.1A2.4.1NotesHow many staff are home or remote workers?Notes
- A2.4.2A2.4.2NotesHow are home/remote workers connecting to your organisational data and services?Notes
- A2.5A2.5NotesPlease provide a list of network equipment that will be in scope for this assessment (including firewalls and routers).Notes
- A2.5.1A2.5.1NotesIf you are certifying as partial organisation, please list the equipment used to create any sub-sets.Conditional: if No in A2.1Notes
- A2.6A2.6NotesPlease list the quantities and operating systems for your laptops, desktops and virtual desktops within the scope of this assessment.Notes
- A2.6.1A2.6.1NotesPlease list the quantity of thin clients within the scope of this assessment. Please include make and operating systems.Notes
- A2.7A2.7NotesPlease list the quantity of servers, virtual servers, virtual server hosts (hypervisors) and Virtual Desktop Infrastructure (VDI) servers. You must include the operating system.Notes
- A2.8A2.8NotesPlease list the quantities of tablets and mobile devices within the scope of this assessment.Notes
- A2.9A2.9NotesPlease list all the cloud services that are in use by your organisation and provided by a third party.Notes
- A2.10A2.10NotesPlease provide the name and role of the person who is responsible for managing your IT systems in the scope of this assessment.Notes
How do assessors mark section A2?
Assessors read section A2 as a whole and against the scope inventory in A2: every answer must be true across the whole scope and consistent with the rest of the submission.
Related requirements
Frequently asked questions
18, from A2.1 to A2.10. 4 of them are conditional and only appear depending on an earlier answer.
No. None of the A2 questions is an auto-fail, but unclear or contradictory answers are returned by the assessor for more information.
1 Yes/No, 16 notes and 1 multiple choice questions.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh