A2.5.1: Which equipment creates your sub-sets?
If you are certifying as partial organisation, please list the equipment used to create any sub-sets.
Source: IASME Cyber Essentials Danzell question set v16.3
For a partial scope, A2.5.1 needs every router, physical firewall or virtual firewall hosted on a hypervisor that is used to create sub-sets of your network. Software firewalls built into operating systems, such as Windows Firewall, cannot define the boundary of the scope. List the make and model of each device and which sub-set it separates.
Is A2.5.1 an automatic fail?
No. A2.5.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- Please list any routers, physical firewalls, or virtual firewalls (hosted on a hypervisor) that are being used to create sub-sets of your network. Note that software firewalls built into operating systems (e.g., Windows Firewall) cannot be used to define the boundary of the scope for this assessment.
- Logic
- If No in A2.1
- Requirement enforced
- Section D of the requirements: the scope must cover the whole IT infrastructure or a well-defined and separately managed sub-set, and cloud services cannot be excluded.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
What does A2.5.1 ask?
A2.5.1 asks: “If you are certifying as partial organisation, please list the equipment used to create any sub-sets.”
A2.5.1 asks, if you are certifying as a partial organisation, for a list of the equipment used to create any sub-sets. The guidance names routers, physical firewalls and virtual firewalls hosted on a hypervisor, and states that software firewalls built into operating systems, such as Windows Firewall, cannot be used to define the boundary of the scope.
Each device listed here supports the method you described in A2.2.2. If you use VLANs, list the switch or firewall that enforces the separation between VLANs.
What should you write in the notes field for A2.5.1?
Write two to four specific sentences for A2.5.1: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
1 x [Sophos XGS 2100] separating the in-scope corporate network from the [production network] sub-set at [site]. [Core switch make and model] enforcing VLAN [n] for the [lab] sub-set, with inter-VLAN routing blocked on the [firewall]. (Or: not applicable, whole organisation scope.)
Why do applicants fail A2.5.1?
A common reason applicants fail A2.5.1: naming Windows Firewall or host-based rules as the boundary.
- Listing a switch that carries VLANs but leaves routing between them open.
- Equipment named here that does not appear in A2.5 or A2.2.2.
- Leaving it blank when A2.1 says partial organisation.
How do you fix a failing A2.5.1 answer?
If your answer to A2.5.1 would not pass today, fix the control first and then write the answer. In order:
- List the router, physical firewall or hypervisor-hosted virtual firewall that creates each sub-set.
- Replace any reliance on Windows Firewall or other host firewalls with network equipment.
- Make sure each device also appears in A2.5 and matches A2.2.2.
How do assessors check A2.5.1?
What evidence should you keep for A2.5.1?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A2.5.1:
- The configuration of each device that creates a sub-set.
Where to go next
- Sub-setGlossary
- Firewall setup guidesFortiGate, Sophos, DrayTek, Meraki, UniFi, WatchGuard
- Scope: what is in and outSection D of v3.3 explained
- Scope checklistBuild the A2 inventory
- All A2 questionsScope of assessment
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A2 questions
- A2.4.2A2.4.2NotesHow are home/remote workers connecting to your organisational data and services?Notes
- A2.5A2.5NotesPlease provide a list of network equipment that will be in scope for this assessment (including firewalls and routers).Notes
- A2.6A2.6NotesPlease list the quantities and operating systems for your laptops, desktops and virtual desktops within the scope of this assessment.Notes
- A2.6.1A2.6.1NotesPlease list the quantity of thin clients within the scope of this assessment. Please include make and operating systems.Notes
Frequently asked questions
A2.5.1 in the 2026 Danzell Cyber Essentials question set asks: "If you are certifying as partial organisation, please list the equipment used to create any sub-sets." It is a notes question, answered in free text.
For a partial scope, A2.5.1 needs every router, physical firewall or virtual firewall hosted on a hypervisor that is used to create sub-sets of your network. Software firewalls built into operating systems, such as Windows Firewall, cannot define the boundary of the scope. List the make and model of each device and which sub-set it separates.
No. A2.5.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
No. IASME's A2.5.1 guidance says software firewalls built into operating systems cannot be used to define the boundary of the scope.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh