A2.1: Is the assessment for your whole organisation or only part of it?
Is this assessment for your whole organisation or only a part of it?
Source: IASME Cyber Essentials Danzell question set v16.3
Choose 'Whole organisation' in A2.1 if every network, user account and device that accesses your organisation's data and services is in scope. Choose 'Partial organisation' only if some networks are excluded, and only where that separation is made by a firewall or VLAN. A partial scope appears on the certificate and must be justified to the assessor.
Is A2.1 an automatic fail?
No. A2.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Multiple choice a multiple choice question
- IASME guidance
- Your whole organisation includes all networks, user accounts and devices which access your organisation's data and services. Partial organisation would mean that some networks are excluded from scope, this must be done using a firewall or VLAN.
- Requirement enforced
- Section D of the requirements: the scope must cover the whole IT infrastructure or a well-defined and separately managed sub-set, and cloud services cannot be excluded.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
What does A2.1 ask?
A2.1 asks: “Is this assessment for your whole organisation or only a part of it?”
A2.1 asks whether this assessment is for your whole organisation or only a part of it. IASME's guidance defines the whole organisation as all networks, user accounts and devices which access your organisation's data and services. Partial organisation means some networks are excluded from scope, and this must be done using a firewall or VLAN.
The v3.3 requirements say the scope should cover the whole IT infrastructure or, if necessary, a well-defined and separately managed sub-set, with a clear boundary: the business unit managing it, the network boundary and the physical location. Where parts are excluded you must justify the partial scope to your assessor, and the NCSC notes that whole-organisation scopes give the best protection and customer confidence.
Two things can never be excluded: end user devices (a scope without them is not acceptable) and cloud services. See what is in and out of scope and the scope checklist.
Which option should you choose for A2.1?
Choose the option for A2.1 that is enforced today across the whole scope, and complete the notes wherever the option requires them.
Whole organisation is the right answer for most small and medium organisations. Partial organisation is for a genuine, separately managed part of the business, for example a test network or a legacy production line segregated by a firewall or VLAN. If you choose partial, you must complete A2.2, A2.2.1, A2.2.2 and A2.5.1, and the certificate will say 'Partial Organisation'.
Why do applicants fail A2.1?
A common reason applicants fail A2.1: choosing partial to leave out awkward devices, such as Windows 10 laptops or a legacy server, without segregating them by firewall or VLAN.
- Trying to exclude a cloud service or the end user devices, which v3.3 does not allow.
- Claiming segregation by security groups, microsegmentation or other software methods, which A2.2.2 says are not compliant.
- Choosing whole organisation while A6.7 describes unsupported software on a sub-set that still has internet access, which forces a partial scope.
How do you fix a failing A2.1 answer?
If your answer to A2.1 would not pass today, fix the control first and then write the answer. In order:
- Start from whole organisation: every network, account, device and cloud service that touches organisational data.
- Choose partial only for a genuinely separate part of the business, segregated by a firewall or VLAN.
- If you were planning to use partial scope to hide unsupported devices, upgrade or remove them instead, or isolate them with no internet access (A6.7).
- Never exclude end user devices or cloud services; v3.3 does not allow it.
How do assessors check A2.1?
What evidence should you keep for A2.1?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A2.1:
- A network diagram showing the scope boundary and any sub-sets.
- For a partial scope, the written justification you gave the assessor.
Where to go next
Other A2 questions
- A2.2A2.2NotesIf you are certifying part of your organisation, please write a detailed description of the scope here.Notes
- A2.2.1A2.2.1NotesPlease provide a description of any networks that have been excluded from the assessment by creating a sub-set.Notes
- A2.2.2A2.2.2NotesWhere one or more sub-sets have been created, please describe how this has been achieved.Notes
- A2.3A2.3NotesAre the networks included in the scope of this assessment being used at the company locations you provided earlier?Notes
Frequently asked questions
A2.1 in the 2026 Danzell Cyber Essentials question set asks: "Is this assessment for your whole organisation or only a part of it?" It is a multiple choice question.
Choose 'Whole organisation' in A2.1 if every network, user account and device that accesses your organisation's data and services is in scope. Choose 'Partial organisation' only if some networks are excluded, and only where that separation is made by a firewall or VLAN. A partial scope appears on the certificate and must be justified to the assessor.
No. A2.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Whole organisation covers every network, account and device that accesses your data and services. Partial organisation excludes some networks, separated by a firewall or VLAN. The certificate states which one applies.
Only if they sit on a sub-set segregated by a firewall or VLAN, and unsupported devices must also have no internet access. Simply leaving them off the list is not a partial scope.
No. v3.3 states that cloud services cannot be excluded from scope, and A2.9 repeats it.
It depends on the customer. A partial certificate says 'Partial Organisation' and the detail is held on the certificate platform. Check that the part a contract cares about is inside the scope.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh