A2.9: List every cloud service your organisation uses
Please list all the cloud services that are in use by your organisation and provided by a third party. Please note that cloud services cannot be excluded from the scope of Cyber Essentials.
Source: IASME Cyber Essentials Danzell question set v16.3
A compliant A2.9 answer lists every third-party cloud service that stores or processes your organisation's data, grouped as IaaS, PaaS and SaaS, with social media accounts included. Cloud services cannot be excluded from scope, so the list should match your subscriptions and single sign-on records, and every service on it must have MFA where offered.
Is A2.9 an automatic fail?
No. A2.9 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- You need to include details of all your cloud services. This includes all types of services - Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS).
- Requirement enforced
- Section D of the requirements: the scope must cover the whole IT infrastructure or a well-defined and separately managed sub-set, and cloud services cannot be excluded.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
What does A2.9 ask?
A2.9 asks: “Please list all the cloud services that are in use by your organisation and provided by a third party. Please note that cloud services cannot be excluded from the scope of Cyber Essentials.”
A2.9 asks for all the cloud services in use by your organisation and provided by a third party, and states in the question itself that cloud services cannot be excluded from the scope of Cyber Essentials. This is one of the six changes in v3.3.
The definition that applies: a cloud service is an on-demand, scalable service, hosted on shared infrastructure, and accessible via the internet, accessed via an account and storing or processing data for your organisation. IaaS, PaaS and SaaS all count, and the guidance adds that social media accounts such as Facebook, LinkedIn and X are also considered to be cloud services.
The list you give here is cross-checked against A7.14 to A7.17. Every service that offers MFA must have it enforced for all users and administrators. See cloud services in scope for the IaaS, PaaS and SaaS responsibility table.
What should you write in the notes field for A2.9?
Write two to four specific sentences for A2.9: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
SaaS: Microsoft 365 (email, SharePoint, Teams), [accounting platform], [CRM], [HR system], [file transfer], [password manager], [MDM or RMM console]. PaaS: [Azure App Service or none]. IaaS: [Azure virtual machines in subscription X, or none]. Social media: LinkedIn company page, [X, Facebook]. All services above provide MFA and it is enforced for all users and administrators through [Entra ID conditional access / the service's own MFA setting]. Services that do not offer MFA are listed in A7.15: [none]. The list was compiled from [finance subscriptions and Entra ID app registrations] on [date] and is owned by [role].
Why do applicants fail A2.9?
A common reason applicants fail A2.9: listing only Microsoft 365 or Google Workspace and forgetting finance, HR, CRM, file transfer, the MSP's remote tool and social media.
- Listing a service here without MFA enforced, which then fails A7.16 or A7.17 automatically.
- Describing services as 'various SaaS tools' rather than naming them.
- Trying to exclude a cloud service because 'it only holds marketing data'. Nothing in the cloud can be excluded.
How do you fix a failing A2.9 answer?
If your answer to A2.9 would not pass today, fix the control first and then write the answer. In order:
- Pull every subscription from finance records and every app registration from your single sign-on or identity provider.
- Ask each team which tools they use, then add social media accounts and the website platform.
- Group the list as IaaS, PaaS and SaaS and remove anything no longer used.
- Check MFA is offered and enforced on each service before you answer A7.14 to A7.17.
How do assessors check A2.9?
What evidence should you keep for A2.9?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A2.9:
- A list of cloud subscriptions from finance records and single sign-on app registrations, dated.
- For each service, a note of whether MFA is offered and how it is enforced.
Where to go next
- Cloud services in scopeIaaS, PaaS and SaaS
- Shared responsibility modelGlossary
- CE Plus test 4: MFA on cloud servicesCyber Essentials Plus
- Scope: what is in and outSection D of v3.3 explained
- Scope checklistBuild the A2 inventory
- All A2 questionsScope of assessment
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A2 questions
- A2.6.1A2.6.1NotesPlease list the quantity of thin clients within the scope of this assessment. Please include make and operating systems.Notes
- A2.7A2.7NotesPlease list the quantity of servers, virtual servers, virtual server hosts (hypervisors) and Virtual Desktop Infrastructure (VDI) servers. You must include the operating system.Notes
- A2.8A2.8NotesPlease list the quantities of tablets and mobile devices within the scope of this assessment.Notes
- A2.10A2.10NotesPlease provide the name and role of the person who is responsible for managing your IT systems in the scope of this assessment.Notes
Frequently asked questions
A2.9 in the 2026 Danzell Cyber Essentials question set asks: "Please list all the cloud services that are in use by your organisation and provided by a third party. Please note that cloud services cannot be excluded from the scope of Cyber Essentials." It is a notes question, answered in free text.
A compliant A2.9 answer lists every third-party cloud service that stores or processes your organisation's data, grouped as IaaS, PaaS and SaaS, with social media accounts included. Cloud services cannot be excluded from scope, so the list should match your subscriptions and single sign-on records, and every service on it must have MFA where offered.
No. A2.9 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Yes. The A2.9 guidance states that social media accounts such as Facebook, LinkedIn and X are considered cloud services. List them and enable MFA on them; all three offer it.
No. v3.3 states that cloud services cannot be excluded from scope, and A2.9 repeats it. Any third-party cloud service that stores or processes your organisation's data is in.
If the account is used for business purposes, for example a personal Dropbox that holds client files, it is accessed via an email address used for business purposes and stores organisational data, so it meets the definition. Better to stop the practice and move the data into a managed service.
Test case 4 tests every cloud service declared in scope for MFA on user and administrator access, using an untrusted device or incognito browser. Where several services share an authentication service, the test is done once per authentication service.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh