A2.2.1: Which networks have you excluded with a sub-set?
Please provide a description of any networks that have been excluded from the assessment by creating a sub-set.
Source: IASME Cyber Essentials Danzell question set v16.3
For a partial scope, A2.2.1 needs a description of each network excluded from the assessment by a sub-set: its name, purpose and location, and how it is separated from the in-scope network by a firewall or VLAN. IASME does not publish this answer. Give enough detail for the assessor to see the excluded network is genuinely segregated.
Is A2.2.1 an automatic fail?
No. A2.2.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- This information will not be made public. Definition of sub-set: A sub-set is part of the organisation whose network is segregated from the rest of the organisation by a firewall or VLAN.
- Logic
- If 'partial' in A2.1
- Requirement enforced
- Section D of the requirements: the scope must cover the whole IT infrastructure or a well-defined and separately managed sub-set, and cloud services cannot be excluded.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
What does A2.2.1 ask?
A2.2.1 asks: “Please provide a description of any networks that have been excluded from the assessment by creating a sub-set.”
A2.2.1 asks for a description of any networks that have been excluded from the assessment by creating a sub-set. IASME's guidance says this information will not be made public, and defines a sub-set as part of the organisation whose network is segregated from the rest by a firewall or VLAN.
Excluded networks usually fall into three groups: networks running unsupported software that must have no internet access (A6.7), development and test networks (which A2.4 says must not be in scope), and operational technology such as building management or production systems. See the glossary entries for sub-set and VLAN.
What should you write in the notes field for A2.2.1?
Write two to four specific sentences for A2.2.1: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
[Network name], [location], used for [purpose, e.g. CNC machine control running an unsupported operating system]. Segregated from the in-scope corporate network by [firewall make and model / VLAN n on switch make and model]. Internet access: [none / outbound only via a separate connection]. Devices on it: [n], none of which access organisational email or cloud services.
Why do applicants fail A2.2.1?
A common reason applicants fail A2.2.1: describing an excluded network that users also reach from in-scope laptops with no firewall between them.
- Segregation by Windows Firewall or security groups, which A2.2.2 and A2.5.1 say cannot define the boundary.
- Excluding a network that hosts staff email or cloud access, which brings it back into scope.
- Leaving out the method of segregation so the assessor cannot judge it.
How do you fix a failing A2.2.1 answer?
If your answer to A2.2.1 would not pass today, fix the control first and then write the answer. In order:
- For each excluded network, give its name, location and purpose.
- Name the firewall or VLAN that separates it and confirm whether it has internet access.
- Confirm no in-scope user reaches email or cloud services from it; if they do, it belongs in scope.
How do assessors check A2.2.1?
What evidence should you keep for A2.2.1?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A2.2.1:
- A diagram of each excluded network and the firewall or VLAN that separates it.
Where to go next
- Sub-setGlossary
- VLANGlossary
- Development and test networksScope rules
- Scope: what is in and outSection D of v3.3 explained
- Scope checklistBuild the A2 inventory
- All A2 questionsScope of assessment
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A2 questions
- A2.1A2.1Multiple choiceIs this assessment for your whole organisation or only a part of it?Multiple choice
- A2.2A2.2NotesIf you are certifying part of your organisation, please write a detailed description of the scope here.Notes
- A2.2.2A2.2.2NotesWhere one or more sub-sets have been created, please describe how this has been achieved.Notes
- A2.3A2.3NotesAre the networks included in the scope of this assessment being used at the company locations you provided earlier?Notes
Frequently asked questions
A2.2.1 in the 2026 Danzell Cyber Essentials question set asks: "Please provide a description of any networks that have been excluded from the assessment by creating a sub-set." It is a notes question, answered in free text.
For a partial scope, A2.2.1 needs a description of each network excluded from the assessment by a sub-set: its name, purpose and location, and how it is separated from the in-scope network by a firewall or VLAN. IASME does not publish this answer. Give enough detail for the assessor to see the excluded network is genuinely segregated.
No. A2.2.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
No. IASME's guidance says the information in A2.2.1 will not be made public.
Yes. IASME's definition of a sub-set is a network segregated from the rest of the organisation by a firewall or VLAN. Software methods such as security groups or microsegmentation are not accepted.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh