Cyber Essentials scope: what is in and out (v3.3)

How is the Cyber Essentials scope defined?

The Cyber Essentials scope is either the whole IT infrastructure used for your business or a well-defined, separately managed sub-set, with a clear boundary: the business unit managing it, the network boundary and the physical location.

Your assessment and certification should cover the whole of the IT infrastructure used to carry out your organisation's business, or if necessary, a well-defined and separately managed sub-set. Either way, you must clearly define the scope boundary: the business unit managing it, the network boundary and physical location. You must agree the scope with the Certification Body before assessment begins.

Organisations that choose a scope which includes their whole IT infrastructure achieve the best protection and maximise their customers' confidence. Where parts of the infrastructure are excluded, you will need to justify the reason for a partial scope to your assessor. A2.1 asks whether the assessment is whole or partial; A2.2 describes a partial scope, and A2.2.1 and A2.2.2 describe any sub-set used to exclude networks.

A partial scope changes what the certificate says. The A2.2 guidance explains that the certificate reads ‘Partial Organisation, see certificate platform for details’, with your full scope description available through the Blockmark certificate platform, while the excluded networks you describe in A2.2.1 are not made public. Sub-sets must be created with a firewall or VLAN: A2.2.2 says security groups, microsegmentation and other software-based methods are not compliant.

Which devices and software are in scope?

Any in-scope device or software that can accept connections from the internet, make outbound connections to it, or control data flowing between the two is covered by the requirements.

The requirements apply to all devices and software in scope and which meet any of these conditions:

• can accept incoming network connections from internet-connected devices
• can establish outbound connections to devices via the internet
• control the flow of data between any of the above devices and the internet

v3.3 removed the earlier reference to 'untrusted connections'. A scope that does not include end user devices is not acceptable. If your organisation's data or services are hosted on cloud services, these services must be in scope.

Are devices not owned by your organisation in scope?

It depends who owns and uses them: devices your organisation loans to third parties are always in scope, while other third-party devices follow Table 2 of the requirements.

All end user devices your organisation owns that are loaned to a third party must be included in the assessment scope. For devices not owned by your organisation, Table 2 of the requirements applies:

For devices out of scope, your organisation is still responsible for confirming that the devices interacting with organisational services and data are configured correctly. See third-party devices.

Can cloud services be excluded from scope?

No. Under v3.3 cloud services cannot be excluded from the Cyber Essentials scope: if organisational data or services are hosted on them, they are in.

For cloud services the applicant is always responsible for ensuring all controls are implemented, but some can be implemented by the provider. Table 1 shows who typically does what for IaaS, PaaS and SaaS:

Which questions cover scope?

Section A2 of the Danzell question set covers scope in 18 questions, A2.1 to A2.10, from whole or partial scope through to the device and cloud service inventory.

How do assessors check scope?