Cyber Essentials scope: accounts used by third parties and managed infrastructure
Every account your organisation owns is in scope, even when a supplier, contractor or MSP uses it. If a third party manages your infrastructure you must still confirm the controls are met.
All accounts your organisation owns are in scope for Cyber Essentials, even when they are used by a supplier, contractor or managed service provider to support your infrastructure. If you use externally managed services such as remote administration, you must be able to confirm the technical controls are being met and demonstrate that in your assessment answers.
- Rule
- All accounts that your organisation owns are in scope, even when used by a third party
- Managed services
- You must be able to confirm that the Cyber Essentials technical controls are being met and demonstrate this in your assessment answers
- Typical accounts
- MSP admin accounts in Microsoft 365, RMM agents, firewall management logins, contractor VPN accounts
- Questions
- A2.10A7.2A7.5A7.8A7.16AUTO-FAIL
- Source
- Requirements for IT Infrastructure v3.3, Section D(v), Accounts used by third parties and managed infrastructure
Which third-party accounts are in scope?
Every account your organisation owns, whoever uses it. The requirements name suppliers, contractors and Managed Service Providers (MSPs) managing or supporting your infrastructure. In practice that means the MSP's global administrator account in your Microsoft 365 tenant, the RMM tool's service account on your servers, the firewall login your network partner uses, and any contractor accounts in your identity provider.
The user access control requirements say the same thing from the other side: being in control of your accounts also includes third party accounts, for example, accounts used by your support services.
What controls apply to MSP accounts?
The same as any other account. Unique credentials per person, not one shared 'MSP admin' login (A7.2). A formal process for granting admin access (A7.5). Tracking and reviewing who holds admin accounts, including the MSP's engineers (A7.8, A7.9). MFA on every cloud admin account, including the MSP's (A7.16, an auto-fail). Removal when the engagement ends (A7.3).
What if an MSP manages our whole IT?
The scope is still yours and so is the certificate. If you use externally managed services such as remote administration, you must be able to confirm that the technical controls are being met and demonstrate this in your answers. Ask the provider for their patching cadence, firewall review dates, admin account list and MFA policy, and write the answers in your own words. A2.10 asks for the person responsible for managing your IT systems, and its guidance says that person must be a member of your organisation and cannot be employed by your outsourced IT provider.
Many MSPs hold their own Cyber Essentials certificate. That helps, but it does not certify your scope.
How do assessors check this?
Related requirements
Frequently asked questions
No. The certificate is for the applicant organisation's scope. Your MSP's certificate shows their own environment meets the controls; it does not demonstrate that your tenant, devices and accounts do. You must confirm the controls in your own answers.
Devices owned by a third-party contractor are out of scope under Table 2, but any account you issue to the contractor is in scope. Devices you loan to a contractor are in scope. You remain responsible for confirming that out-of-scope devices interacting with your data are configured correctly.
The person responsible for managing your IT systems in scope. The A2.10 guidance says this person must be a member of your organisation and cannot be a person employed by your outsourced IT provider. If a managed service provider runs your IT, name your internal owner, for example the operations director, and describe the MSP's role in the notes on the relevant control questions.
The RMM console is a cloud service accessed by account and processing your data, so it belongs in A2.9 and must have MFA on every login, including the MSP's engineers.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh