A2.3: Are your in-scope networks used at the locations you listed?
Are the networks included in the scope of this assessment being used at the company locations you provided earlier?
Source: IASME Cyber Essentials Danzell question set v16.3
A2.3 asks you to confirm that the networks in scope are used at the company locations you gave in A1.5.1. If they are also used at other locations, give the number of additional sites. Home workers' addresses are not counted. The answer lets the assessor check that each site has a protected boundary.
Is A2.3 an automatic fail?
No. A2.3 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- This does not include the addresses of home/remote workers. 1.
- Requirement enforced
- Section D of the requirements: the scope must cover the whole IT infrastructure or a well-defined and separately managed sub-set, and cloud services cannot be excluded.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
What does A2.3 ask?
A2.3 asks: “Are the networks included in the scope of this assessment being used at the company locations you provided earlier?”
A2.3 asks whether the networks included in the scope of this assessment are being used at the company locations you provided earlier. The guidance says this does not include the addresses of home or remote workers, and that if in-scope networks are used at locations other than those in A1.5.1 you should give the number of additional sites.
Read it with A2.3.1 (does each site have its own internet connection), A2.4 (the list of networks) and A2.5 (the firewalls and routers that protect them).
What should you write in the notes field for A2.3?
Write two to four specific sentences for A2.3: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
Yes. The in-scope networks described in A2.4 are used at [all / the following] locations listed in A1.5.1: [site names]. [They are also used at n additional sites: e.g. two client offices where staff connect to the client's guest wifi using software firewalls.] Home workers are covered in A2.4.1 and A2.4.2.
Why do applicants fail A2.3?
A common reason applicants fail A2.3: confirming the A1.5.1 list when staff also work regularly from a client site or a second office.
- Counting home workers as sites.
- Forgetting a pop-up or seasonal location that uses the same network equipment.
- Not explaining how a site without its own equipment is protected.
How do you fix a failing A2.3 answer?
If your answer to A2.3 would not pass today, fix the control first and then write the answer. In order:
- Compare A1.5.1 with where staff actually work, including client sites and second offices.
- Give the number of additional sites where in-scope networks are used.
- Make sure each site has a boundary device in A2.5 or relies on software firewalls you have described.
How do assessors check A2.3?
What evidence should you keep for A2.3?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A2.3:
- A site list showing which networks are used where.
Where to go next
- Home and remote workingScope rules
- Boundary firewallGlossary
- Scope: what is in and outSection D of v3.3 explained
- Scope checklistBuild the A2 inventory
- All A2 questionsScope of assessment
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A2 questions
- A2.2.1A2.2.1NotesPlease provide a description of any networks that have been excluded from the assessment by creating a sub-set.Notes
- A2.2.2A2.2.2NotesWhere one or more sub-sets have been created, please describe how this has been achieved.Notes
- A2.3.1A2.3.1Yes/NoDo you have an internet connection for each site in your organisation?Yes/No
- A2.3.2A2.3.2NotesIf no, please describe the way that your sites are connected.Notes
Frequently asked questions
A2.3 in the 2026 Danzell Cyber Essentials question set asks: "Are the networks included in the scope of this assessment being used at the company locations you provided earlier?" It is a notes question, answered in free text.
A2.3 asks you to confirm that the networks in scope are used at the company locations you gave in A1.5.1. If they are also used at other locations, give the number of additional sites. Home workers' addresses are not counted. The answer lets the assessor check that each site has a protected boundary.
No. A2.3 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
No. IASME's A2.3 guidance says the question does not include the addresses of home or remote workers. They are covered by A2.4.1 and A2.4.2.
Say so and give the number of sites. Devices on a network you do not control must use a software firewall, which v3.3 also requires on untrusted networks such as public wifi.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh