A2.2: How do you describe a partial scope?
If you are certifying part of your organisation, please write a detailed description of the scope here.
Source: IASME Cyber Essentials Danzell question set v16.3
If you chose partial organisation in A2.1, A2.2 needs a full description of what the certificate covers: the business unit, the networks, the locations, and the devices, users and cloud services inside the boundary. The certificate itself only says 'Partial Organisation, see certificate platform for details'; this description is what customers will see there.
Is A2.2 an automatic fail?
No. A2.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- If you are certifying only part of the organisation, the scope description on the certificate will say ‘Partial Organisation, see certificate platform for details’. The full scope description here will be available via the Blockmark system.
- Logic
- If 'partial organisation' has been selected in A2.1. Answer to allow an unlimited number of characters.
- Requirement enforced
- Section D of the requirements: the scope must cover the whole IT infrastructure or a well-defined and separately managed sub-set, and cloud services cannot be excluded.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
What does A2.2 ask?
A2.2 asks: “If you are certifying part of your organisation, please write a detailed description of the scope here.”
A2.2 appears only if you selected partial organisation in A2.1. It asks for a detailed description of the scope. IASME's guidance explains that the certificate will say 'Partial Organisation, see certificate platform for details', and that the full scope description will be available through the certificate platform.
The v3.3 requirements ask you to define the scope boundary in three dimensions: the business unit managing it, the network boundary and the physical location. Write the description so a customer reading it can tell whether the service they buy from you is inside the boundary. The networks you exclude go in A2.2.1 and the method of segregation in A2.2.2.
What should you write in the notes field for A2.2?
Write two to four specific sentences for A2.2: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
The scope covers [business unit, e.g. 'the UK professional services business'], managed by [team], operating from [sites]. It includes the [corporate network at head office], all [n] staff laptops and mobile devices, all home workers, and every cloud service listed in A2.9. It excludes the [production line control network / test and development network] at [site], which is segregated from the in-scope network by [firewall make and model / VLAN] and has [no internet access / its own internet connection]. Users of in-scope services: [n].
Why do applicants fail A2.2?
A common reason applicants fail A2.2: a one-line description such as 'Head office' that does not say which networks, devices or services are inside the boundary.
- Describing what is excluded but not what is included.
- A scope that leaves out the end user devices or a cloud service, which v3.3 does not allow.
- A description that does not match the networks in A2.4 or the equipment in A2.5.1.
How do you fix a failing A2.2 answer?
If your answer to A2.2 would not pass today, fix the control first and then write the answer. In order:
- Describe the boundary in three parts: the business unit managing it, the network boundary and the physical locations.
- State what is inside (devices, users, cloud services) as well as what is excluded.
- Check the description against A2.4, A2.2.1 and A2.5.1 so the networks and equipment match.
How do assessors check A2.2?
What evidence should you keep for A2.2?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A2.2:
- The scope description and a diagram showing the in-scope and excluded networks.
Where to go next
Other A2 questions
- A2.1A2.1Multiple choiceIs this assessment for your whole organisation or only a part of it?Multiple choice
- A2.2.1A2.2.1NotesPlease provide a description of any networks that have been excluded from the assessment by creating a sub-set.Notes
- A2.2.2A2.2.2NotesWhere one or more sub-sets have been created, please describe how this has been achieved.Notes
- A2.3A2.3NotesAre the networks included in the scope of this assessment being used at the company locations you provided earlier?Notes
Frequently asked questions
A2.2 in the 2026 Danzell Cyber Essentials question set asks: "If you are certifying part of your organisation, please write a detailed description of the scope here." It is a notes question, answered in free text.
If you chose partial organisation in A2.1, A2.2 needs a full description of what the certificate covers: the business unit, the networks, the locations, and the devices, users and cloud services inside the boundary. The certificate itself only says 'Partial Organisation, see certificate platform for details'; this description is what customers will see there.
No. A2.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
The certificate says 'Partial Organisation, see certificate platform for details', and IASME's A2.2 guidance says the full description is available via the certificate platform. Write it with that reader in mind.
Detailed enough that someone outside your organisation can tell what is and is not certified: the business unit, sites, networks, devices, users and cloud services inside the boundary, and what is excluded.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh