Check if you’d auto-fail

Step-by-step v3.3 scope statement · Browser-only privacy

Build your Cyber Essentials scope

Getting scope wrong is one of the fastest ways to fail an assessment. Under the April 2026 Danzell rules, you must list every legal entity in scope with its company number and address, include every cloud service, and justify how any excluded network is segregated. Everything you enter here stays in your browser unless you choose to email it to yourself.

1. Organisation & legal entities
2. People & places
3. End-user devices & servers

Enter quantities and pick the oldest operating system version in use for each type. We’ll flag unsupported versions automatically.

4. Boundary firewalls & office routers
5. Cloud services (cannot be excluded from scope)

Mark every cloud service your staff log in to with work credentials or a business email address, and its current Multi-Factor Authentication (MFA) status.

Microsoft 365 / Google Workspace (Email, SharePoint, OneDrive, Teams)
Accounting & payroll (e.g. Xero, Sage, QuickBooks, BrightPay)
CRM, practice or line-of-business cloud software
Website CMS, domain registrar & DNS portal
6. Exclusions (if any)

Why scope trips up so many assessments

Before you answer a single technical question in Cyber Essentials, you must agree your boundary of scope with your Certification Body. Under the April 2026 Danzell updates (IASME) and the NCSC Requirements for IT Infrastructure v3.3:

  • Every legal entity must be named: You must list the legal name, registered address and company number of every entity covered by the certificate. These appear on IASME’s digital certificate platform.
  • Cloud services can never be excluded: Any online service accessed with company credentials or a business email address that stores or processes your organisation’s data is automatically in scope.
  • End-user devices cannot be excluded: A scope that leaves out staff laptops, desktops or phones that access company data is not acceptable.
  • Exclusions need network segregation: If you exclude an older machine or a separate business unit, it must sit on a segregated network (behind a firewall or Virtual Local Area Network (VLAN) with no internet connection or path to in-scope systems) and you must explain that separation to the assessor.

Read our full guide on Cyber Essentials scope: what’s in and what’s out and which cloud services count.