Cyber Essentials scope: devices used by third parties (Table 2)
Table 2 of the requirements: which devices are in or out of scope for employees, volunteers, trustees, research assistants, students, MSP administrators, contractors and customers.
Every end user device your organisation owns is in scope, including devices loaned to a third party. For devices you do not own, Table 2 of the requirements decides: BYOD belonging to employees, volunteers, trustees and research assistants is in scope, while devices owned by students, MSP administrators, third-party contractors and customers are out of scope.
- Owned by you
- Always in scope, including end user devices loaned to a third party
- BYOD in scope
- Employees, volunteers, trustees, university research assistants
- Out of scope
- Devices owned by students, MSP administrators, third party contractors and customers
- Residual duty
- You are still responsible for confirming that out-of-scope devices interacting with organisational services and data are configured correctly
- Source
- Requirements for IT Infrastructure v3.3, Section D(vi), Devices used by third parties
Which third-party devices are in scope?
All end user devices your organisation owns that are loaned to a third party must be included in the assessment scope. For devices not owned by your organisation, the requirements give this table:
| Role | Owned by your organisation | Owned by a third party | BYOD |
|---|---|---|---|
| Employee | In scope | N/A | In scope |
| Volunteer | In scope | N/A | In scope |
| Trustee | In scope | N/A | In scope |
| University research assistant | In scope | N/A | In scope |
| Student | In scope | N/A | Out of scope |
| MSP administrator | In scope | Out of scope | Out of scope |
| Third party contractor | In scope | Out of scope | Out of scope |
| Customer | In scope | Out of scope | Out of scope |
What am I still responsible for on out-of-scope devices?
The requirements are clear that for devices out of scope of the assessment, your organisation is still responsible for confirming that the devices interacting with organisational services and data are configured correctly. How you do that is up to you, because it falls outside the assessment scope. Conditional access, contractual clauses with the MSP, or a supplier questionnaire are common approaches.
How does this affect charities and universities?
Volunteers and trustees are treated like employees: their own devices are in scope when used for organisational data or services. Students' own devices are out of scope, but university-owned devices issued to students are in scope. University research assistants' own devices are in scope.
How do assessors check this?
Related requirements
Frequently asked questions
No. Devices owned by customers are out of scope under Table 2, as are devices owned by third-party contractors and MSP administrators. Any device you own and loan to a customer is in scope.
Yes. Volunteer BYOD is in scope, in the same way as employee BYOD, whenever it accesses organisational data or services.
Not for your assessment; MSP administrator devices owned by the MSP or by the engineer are out of scope. The accounts they use in your environment are in scope, and you remain responsible for confirming their devices are configured correctly, which is usually done through contract.
In scope. All end user devices your organisation owns that are loaned to a third party must be included in the assessment scope and meet all five controls.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh