Which cloud services count for Cyber Essentials?
Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).
The new v3.3 definition of a cloud service
Before April 2026, applicants often argued over whether a small online tool counted as “cloud infrastructure”. Version 3.3 of the NCSC Requirements for IT Infrastructure (page 4) settles this with an explicit definition:
A cloud service is an on-demand, scalable service, hosted on shared infrastructure, and accessible via the internet. For Cyber Essentials, it is accessed via an account (either credentials issued by your organisation or an email address used for business purposes) and stores or processes data for your organisation.
And Section D (page 7) adds the hard rule: “If your organisation’s data or services are hosted on cloud services, these services must be in scope. Cloud services cannot be excluded from scope.”
Shared responsibility: who implements which control?
You are always responsible for making sure the five controls are met on your cloud services, even when the cloud provider handles the underlying servers. Section D(iv) of v3.3 (Table 1, page 10) breaks this down across the three types of cloud service:
| Control | IaaS (e.g. Azure VMs, AWS EC2) | PaaS (e.g. Azure Web Apps, AWS Lambda) | SaaS (e.g. Microsoft 365, Xero, Dropbox) |
|---|---|---|---|
| 1. Firewalls | Both your organisation and the cloud provider | The cloud provider and sometimes your organisation | The cloud provider |
| 2. Secure configuration | Both your organisation and the cloud provider | Both your organisation and the cloud provider | Both your organisation and the cloud provider |
| 3. Security updates | Both your organisation and the cloud provider | Both your organisation and the cloud provider | The cloud provider |
| 4. User access control | Your organisation | Your organisation | Your organisation |
| 5. Malware protection | Both your organisation and the cloud provider | The cloud provider and sometimes your organisation | The cloud provider |
Notice what that table means for a typical small business using Software as a Service (SaaS): Microsoft or Xero patches the servers and runs the boundary firewall, but you are 100% responsible for User Access Control (MFA, separate admin accounts, removing leavers) and your side of Secure Configuration.
How to find every cloud service your staff actually use
“Shadow IT” — where a team member signs up to a web tool using their @yourcompany.co.uk email address — is in scope under the v3.3 definition if business data goes into it. Four practical ways to uncover them all in an afternoon:
- Check bank and company card statements: Look through the last 12 months for recurring software subscriptions (annual as well as monthly).
- Check Microsoft Entra ID Enterprise Applications: In the Entra admin centre, go to Identity → Applications → Enterprise applications to see every third-party site where staff have clicked “Sign in with Microsoft”.
- Search mailboxes for “Verify your email” or “Welcome to”: Or ask each department head to list the browser tabs they open every week.
- Review password managers and browser saved passwords: Export the list of domains stored in your team’s password manager.
The commonly forgotten cloud services that count
- Accounting, payroll and expenses: Xero, QuickBooks, Sage, Dext, BrightPay, Pleo.
- HR and recruitment: Breathe HR, CharlieHR, BrightHR, Workable.
- Sector and line-of-business systems: Clio, LEAP, Osprey (law); IRIS, TaxCalc, Karbon (accountancy); Bullhorn, Vincere (recruitment).
- Marketing, CRM and website editors: HubSpot, Pipedrive, Mailchimp, WordPress/Webflow admin, Canva, LinkedIn/Meta business accounts.
- IT and domain infrastructure: Your domain registrar (e.g. Fasthosts, Cloudflare, 123 Reg), DNS console, VoIP phone portal, and backup dashboard.
- Free accounts holding business data: A free Trello board, free Dropbox, or free ChatGPT account registered with a work email address and used to process company documents is still a cloud service in scope under v3.3.Either bring it under company control with MFA, or delete the account and block it.
List and check your cloud services in the free Scope builder
Work out which legal entities, locations, devices and cloud services are in scope and spot unsupported systems before you apply.
Build your Cyber Essentials scope →