A2.4: Which networks are in scope?
Please provide a list of networks that will be in scope for this assessment.
Source: IASME Cyber Essentials Danzell question set v16.3
A2.4 needs a list of every network in scope, each with its name, location and purpose, for example 'Main network at head office for administrative use'. Do not give IP addresses or other technical details. Development, testing and penetration testing networks must not be included. IASME does not publish the answer.
Is A2.4 an automatic fail?
No. A2.4 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- You should include details of each network used in your organisation, including its name, location and purpose (e.g. "Main Network at Head Office for administrative use"). Information provided here will not be made public.
- Requirement enforced
- Section D of the requirements: the scope must cover the whole IT infrastructure or a well-defined and separately managed sub-set, and cloud services cannot be excluded.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
What does A2.4 ask?
A2.4 asks: “Please provide a list of networks that will be in scope for this assessment.”
A2.4 asks for a list of networks that will be in scope for this assessment. IASME's guidance says to include each network used in your organisation with its name, location and purpose, gives the example 'Main Network at Head Office for administrative use', and says the information will not be made public.
Two instructions are easy to miss: do not provide IP addresses or other technical information, and development, testing and pen-testing networks must not be included. If those networks exist they should be segregated as sub-sets (see A2.2.1). Guest wifi that is separated from the business network is usually listed so the assessor knows it exists and is isolated.
What should you write in the notes field for A2.4?
Write two to four specific sentences for A2.4: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
[Network name] at [site], used for [purpose, e.g. staff laptops and printers]. [Guest wifi] at [site], for visitors only, isolated from the staff network by [VLAN / separate SSID with client isolation]. [Network name] at [second site], used for [purpose]. Home workers connect as described in A2.4.2. No development or test networks are in scope.
Why do applicants fail A2.4?
A common reason applicants fail A2.4: listing IP ranges or VLAN IDs, which the guidance says not to provide.
- Including a development or test network, which the guidance says must not be included.
- Forgetting a second site or a warehouse network.
- Leaving out guest wifi so the assessor cannot tell whether visitors share the staff network.
How do you fix a failing A2.4 answer?
If your answer to A2.4 would not pass today, fix the control first and then write the answer. In order:
- List each network by name, site and purpose, without IP ranges or VLAN IDs.
- Include guest wifi, stating how it is isolated from staff devices.
- Remove development, testing and penetration testing networks from the list and segregate them as sub-sets.
How do assessors check A2.4?
What evidence should you keep for A2.4?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A2.4:
- A list of networks with site and purpose, matching the firewall list in A2.5.
Where to go next
Other A2 questions
- A2.3.1A2.3.1Yes/NoDo you have an internet connection for each site in your organisation?Yes/No
- A2.3.2A2.3.2NotesIf no, please describe the way that your sites are connected.Notes
- A2.4.1A2.4.1NotesHow many staff are home or remote workers?Notes
- A2.4.2A2.4.2NotesHow are home/remote workers connecting to your organisational data and services?Notes
Frequently asked questions
A2.4 in the 2026 Danzell Cyber Essentials question set asks: "Please provide a list of networks that will be in scope for this assessment." It is a notes question, answered in free text.
A2.4 needs a list of every network in scope, each with its name, location and purpose, for example 'Main network at head office for administrative use'. Do not give IP addresses or other technical details. Development, testing and penetration testing networks must not be included. IASME does not publish the answer.
No. A2.4 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
No. IASME's A2.4 guidance says do not provide IP addresses or other technical information. Name, location and purpose are enough.
Guest wifi that only visitors use and that is isolated from business devices does not access organisational data. List it so the assessor can see it is separate. If staff devices use it, it is part of your network.
IASME's guidance says development, testing and pen-testing networks must not be included in A2.4. Segregate them as a sub-set by firewall or VLAN.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh