Cyber Essentials scope: what's in and what's out

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

Whole organisation versus a segregated sub-set

Section D of the NCSC Requirements for IT Infrastructure v3.3 (page 6) gives you two choices when defining your boundary of scope:

• Whole organisation (strongly recommended): Covers all IT infrastructure used to carry out your business. For almost every UK firm of 1 to 100 staff, certifying the whole organisation is simpler, gives customers and public sector buyers maximum confidence, and is a mandatory condition if you want the complimentary £25,000 cyber liability insurance policy bundled by IASME (for UK organisations under £20m turnover).
• A segregated sub-set: Covers a clearly defined business unit, physical location or network boundary that is separated from the rest of the organisation by a firewall or Virtual Local Area Network (VLAN).

What changed in scope under Danzell (April 2026)

IASME’s April 2026 Danzell announcement introduced four major changes to how scope is recorded and displayed:

1. Every legal entity must be identified: You must list the legal name, registered address and Companies House (or charity) number of every legal entity included in the scope. All included entities are visible on IASME’s public digital certificate platform.
2. Optional per-entity certificates: If you certify a group of companies under a single overarching scope, you can now request individual certificates for each legal entity for a small additional fee, clearly marked as part of the wider scope.
3. Out-of-scope areas must be described and justified: If you exclude any part of your infrastructure, you must describe what is excluded and justify to the assessor how those excluded networks are kept separate. (Your out-of-scope notes are for the assessor and are not published publicly.)
4. Detailed scope descriptions on the digital certificate: Unrestricted character limits allow your full scope statement to be shown on the digital certificate platform so buyers can see exactly what is covered.

What is always in scope (and what v3.3 simplified)

Under v3.3 (pages 6–12), the technical requirements apply to every device and piece of software in your boundary that can accept incoming network connections from internet-connected devices, establish outbound connections to the internet, or control the flow of data between them. Note that v3.3 removed the older qualifiers “untrusted” and “user-initiated”, removing a major source of confusion.

In practice, three things can never be carved out of a valid scope:

• End-user devices: “A scope that doesn’t include end-user devices isn’t acceptable” (v3.3 page 7). You cannot certify just your server room or just two directors’ laptops while ignoring staff machines.
• Cloud services: Every SaaS, PaaS and IaaS service storing or processing your organisation’s data is in scope (v3.3 page 7).
• Staff BYOD and home-working laptops: Employee-owned phones or computers that access organisational data or services (beyond native voice calls, SMS texts or MFA apps) are in scope.

Third-party devices and accounts: what v3.3 Table 2 says

Section D(v) and D(vi) (pages 11–12 of v3.3) clarify third parties:

• Accounts owned by your organisation (including admin accounts you create for your IT support provider / MSP or a contractor) are always in scope.
• Devices owned by your organisation and loaned to anyone (employees, contractors, students) are always in scope.
• Personal (BYOD) devices belonging to employees, volunteers, trustees and university research assistants are in scope if they access organisational data/services. Devices belonging to external MSP administrators, third-party contractors, customers or students are out of scope of your assessment (though you remain responsible for ensuring they interact safely with your data).