Cyber Essentials scope: software development and web applications
Publicly available commercial web applications are in scope by default; bespoke and custom components are out of scope. v3.3 introduces the Software Security Code of Practice.
Cyber Essentials puts publicly available commercial web applications in scope by default, while bespoke and custom components of web applications are out of scope. The requirements say the best way to mitigate application vulnerabilities is thorough development and testing in line with commercial best practice, and v3.3 points developers to the Software Security Code of Practice.
- In scope
- Publicly available commercial web applications (rather than apps developed in-house)
- Out of scope
- Bespoke and custom components of web applications
- New in v3.3
- Software Security Code of Practice introduced in the Software Development section
- Still assessed
- The servers, IaaS or PaaS that host the application, and the accounts that administer it
- Source
- Requirements for IT Infrastructure v3.3, Section D(vii), Software development
Is our own web application in scope?
The bespoke and custom components are not. Commercial, publicly available web applications, such as a commercial CRM, an off-the-shelf customer portal or a hosted e-commerce platform, are in scope by default because they are software that must be supported and updated within the 14-day rule. The platform under your custom code is also in scope: the server or IaaS instance, its operating system, the web server and the framework packages.
What does the Software Security Code of Practice change?
v3.3 introduces the Software Security Code of Practice, published on GOV.UK, in the software development section. The requirements state that the best way to mitigate vulnerabilities in applications is development and testing in line with commercial best practice, and refer readers to the Code for further details. It is a pointer, not a new assessed control: Cyber Essentials does not audit your development lifecycle.
How do hosted applications appear in the question set?
Through A5.4, which asks whether you run or host external services that give users access to non-public data across the internet, including SaaS or PaaS products you provide to customers. If yes, A5.5 asks which authentication option protects them, A5.6 how you change passwords after a compromise and A5.7 how you stop brute force when MFA is not used. The hosting servers are listed in A2.7 or, for IaaS, in A2.9.
How do assessors check this?
Related requirements
Frequently asked questions
The bespoke and custom components are out of scope. The infrastructure that hosts it, the commercial components it depends on and the accounts that administer it are all in scope.
No. Cyber Essentials Plus includes an external vulnerability scan of your internet-facing addresses, but not an application penetration test. The requirements recommend development and testing in line with commercial best practice and point to the Software Security Code of Practice.
Software includes libraries and interpreters, so the frameworks and packages on your in-scope servers must be supported and have critical fixes applied within 14 days. Bespoke code built on them is out of scope.
A UK government code of practice for organisations that develop or sell software, referenced for the first time in the v3.3 requirements. Cyber Essentials cites it as guidance for mitigating application vulnerabilities; it is not an assessed control.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh