A2.2.2: How have you created your sub-sets?
Where one or more sub-sets have been created, please describe how this has been achieved.
Source: IASME Cyber Essentials Danzell question set v16.3
A2.2.2 needs the method used to create each sub-set, and the only compliant methods are a firewall or a VLAN. IASME's guidance says security groups, microsegmentation and other software-based methods are not compliant. Name each sub-set and its method in a line, for example 'Test and development network: segregated by firewall' or 'Finance department: VLAN'.
Is A2.2.2 an automatic fail?
No. A2.2.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- Sub-sets must be created using a firewall or VLAN - other methods such as security groups, microsegmentation or software-based methods are not compliant.
- Requirement enforced
- Section D of the requirements: the scope must cover the whole IT infrastructure or a well-defined and separately managed sub-set, and cloud services cannot be excluded.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
What does A2.2.2 ask?
A2.2.2 asks: “Where one or more sub-sets have been created, please describe how this has been achieved.”
A2.2.2 asks, where one or more sub-sets have been created, how this has been achieved. IASME's guidance is unambiguous: sub-sets must be created using a firewall or VLAN, and other methods such as security groups, microsegmentation or software-based methods are not compliant.
The guidance gives two model answers: 'Test/Development network - segregated by firewall' and 'Finance department - VLAN'. If you have no sub-sets, say so. The equipment that creates each one is listed in A2.5.1, and a software firewall on an operating system cannot define the boundary.
What should you write in the notes field for A2.2.2?
Write two to four specific sentences for A2.2.2: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
[Sub-set name]: segregated by [firewall make and model, with a rule set that blocks traffic to and from the in-scope network / VLAN n on switch make and model, with inter-VLAN routing blocked by firewall make and model]. [Second sub-set]: [method]. (Or: no sub-sets have been created; the whole organisation is in scope.)
Why do applicants fail A2.2.2?
A common reason applicants fail A2.2.2: naming Azure network security groups, AWS security groups or a microsegmentation product as the method.
- A VLAN with unrestricted routing to the in-scope VLAN, which separates nothing.
- Relying on Windows Defender Firewall rules on individual devices.
- Leaving the answer blank on a whole-organisation scope instead of stating that there are no sub-sets.
How do you fix a failing A2.2.2 answer?
If your answer to A2.2.2 would not pass today, fix the control first and then write the answer. In order:
- Replace any security-group, microsegmentation or host-firewall method with a firewall (physical or virtual) or a VLAN.
- For VLANs, block routing between the sub-set and the in-scope network on the firewall or layer 3 switch.
- Write one line per sub-set naming the method, or state that no sub-sets exist.
How do assessors check A2.2.2?
What evidence should you keep for A2.2.2?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A2.2.2:
- The firewall rules or VLAN and inter-VLAN routing configuration that create each sub-set.
Where to go next
- VLANGlossary
- Network segregationGlossary
- Firewall setup guidesFortiGate, Sophos, DrayTek, Meraki, UniFi, WatchGuard
- Scope: what is in and outSection D of v3.3 explained
- Scope checklistBuild the A2 inventory
- All A2 questionsScope of assessment
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A2 questions
- A2.2A2.2NotesIf you are certifying part of your organisation, please write a detailed description of the scope here.Notes
- A2.2.1A2.2.1NotesPlease provide a description of any networks that have been excluded from the assessment by creating a sub-set.Notes
- A2.3A2.3NotesAre the networks included in the scope of this assessment being used at the company locations you provided earlier?Notes
- A2.3.1A2.3.1Yes/NoDo you have an internet connection for each site in your organisation?Yes/No
Frequently asked questions
A2.2.2 in the 2026 Danzell Cyber Essentials question set asks: "Where one or more sub-sets have been created, please describe how this has been achieved." It is a notes question, answered in free text.
A2.2.2 needs the method used to create each sub-set, and the only compliant methods are a firewall or a VLAN. IASME's guidance says security groups, microsegmentation and other software-based methods are not compliant. Name each sub-set and its method in a line, for example 'Test and development network: segregated by firewall' or 'Finance department: VLAN'.
No. A2.2.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
No. IASME's A2.2.2 guidance says security groups, microsegmentation and other software-based methods are not compliant. Use a firewall, including a virtual firewall, or a VLAN.
Yes. A2.5.1 asks for routers, physical firewalls or virtual firewalls hosted on a hypervisor used to create sub-sets. Software firewalls built into operating systems cannot define the boundary.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh