Cyber Essentials cloud services scope: IaaS, PaaS and SaaS
Cloud services cannot be excluded from Cyber Essentials scope. Who implements each control depends on whether the service is IaaS, PaaS or SaaS, and the provider's commitment must be in writing.
If your organisation's data or services are hosted on cloud services, those services must be in scope and cannot be excluded. You are always responsible for making sure all five controls are implemented, but for IaaS, PaaS and SaaS some controls are implemented by the provider, and that commitment must appear in a contract, security statement or trust-centre document.
- Rule
- Cloud services cannot be excluded from scope (definitive in v3.3)
- Definition
- An on-demand, scalable service, hosted on shared infrastructure, and accessible via the internet, accessed via an account and storing or processing data for your organisation
- Three types
- IaaS (for example Amazon EC2), PaaS (for example Azure Web Apps), SaaS (for example Microsoft 365)
- Evidence
- Provider commitment via contractual clauses or documents referenced by contract, such as security statements or privacy statements
- Source
- Requirements for IT Infrastructure v3.3, Section D(iv), Cloud services
What counts as a cloud service?
v3.3 adds a definition. A cloud service means an on-demand, scalable service, hosted on shared infrastructure, and accessible via the internet. For the purposes of Cyber Essentials it will be accessed via an account, which may be credentials issued by your organisation or an email address used for business purposes, and will store or process data for your organisation. The A2.9 guidance adds that social media accounts such as Facebook, LinkedIn and X are also considered cloud services.
What is the difference between IaaS, PaaS and SaaS?
The requirements describe three types:
- Infrastructure as a Service (IaaS): the cloud provider delivers virtual servers and network equipment that, much like physical equipment, your organisation configures and manages. Examples include Rackspace, Google Compute Engine or Amazon EC2.
- Platform as a Service (PaaS): the cloud provider delivers and manages the underlying infrastructure, and your organisation provides and manages the applications. Examples include Azure Web Apps and Amazon Web Services Lambda.
- Software as a Service (SaaS): the cloud provider delivers applications, and your organisation then configures the services. You must still make sure that the service is configured securely. Examples include Microsoft 365, Dropbox and Gmail.
Who implements each control in the cloud?
The applicant is always responsible for ensuring all controls are implemented, but some can be implemented by the provider. Table 1 below is the NCSC's view of who typically does what. User access control is yours in every model; that is why MFA on cloud services is your answer to give in A7.16 and A7.17.
How do I prove the provider implements a control?
Where the provider implements a control on your behalf, you must make sure they have committed to it via contractual clauses or documents referenced by contract, such as security statements or privacy statements. Providers usually publish this in a trust centre under a 'shared responsibility model'. Keep the link or document reference so you can cite it if the assessor asks. The shared responsibility model glossary entry explains how to read these documents.
How do I find every cloud service we use?
Start with three sources and compare them: the subscriptions in your finance or expenses system, the enterprise applications registered in your identity provider, and a short survey asking each team which logins they use for work. Add social media accounts, domain and DNS registrars, the MSP's remote monitoring console and any IaaS or PaaS accounts. For each service record the type (IaaS, PaaS or SaaS), whether MFA is available, and whether it is enforced for every user and administrator.
That table answers A2.9 and A7.14 to A7.17 in one go. The AWS, Azure, Microsoft 365 and Entra ID and Google Workspace setup guides cover the main platforms.
How do assessors check this?
Related requirements
Frequently asked questions
No. v3.3 makes the definitive statement that if your organisation's data or services are hosted on cloud services, these services must be in scope, and cloud services cannot be excluded from scope. A2.9 repeats this at the point where you list them.
Yes. The A2.9 guidance states that social media accounts such as Facebook, LinkedIn and X are also considered to be cloud services. List them and enable MFA on them.
Yes, wherever the service provides MFA, for all administrators and all users. Under the 2026 Danzell question set a No to A7.16 or A7.17 is an automatic fail. Services that genuinely offer no MFA are listed in A7.15.
The cloud provider. Table 1 shows security update management for SaaS as the provider's responsibility. You must still make sure the service is supported and that the provider's commitment is in a contract or referenced document, and you configure the service securely.
Yes. The provider delivers virtual servers and network equipment that you configure and manage much like physical equipment. Firewalls, secure configuration, patching, access control and malware protection on the guest are your responsibility, and CE Plus test case 1 scans IaaS addresses.
List it in A7.15. A7.16 and A7.17 then exclude it from the MFA requirement. Check carefully first: the A7.15 guidance says listing a service that does have an MFA option is an automatic fail, and many services offer MFA in account security settings rather than at sign-up.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh