Cloud services in Cyber Essentials: what counts, and what’s yours to configure

Why cloud services are in scope at all

For a modern small business, the crown jewels are not on a server in the cupboard — they are in email, file storage and accounting software run by someone else. A certification that ignored those would be theatre. So the requirements are blunt: cloud services that store or process business data cannot be excluded from scope, and the scope section of the questionnaire (A2.9) asks you to list every one.

What counts as a cloud service

If you sign into it in a browser or app, and business data flows through it, it counts:

• Email and calendars — Microsoft 365, Google Workspace.
• Files — OneDrive, SharePoint, Google Drive, Dropbox.
• Money — Xero, QuickBooks, Sage, FreeAgent; payment platforms like Stripe and GoCardless.
• Customers and projects — HubSpot, Salesforce, Pipedrive, Notion, Trello, Asana, Monday.
• Communication — Slack, Teams, Zoom.
• Marketing and web — Mailchimp, Canva, Shopify, WordPress.
• Business social-media accounts — LinkedIn, Facebook, Instagram, X, TikTok, YouTube. The IASME question set (A2.9) treats these as cloud services, and they are the ones most often forgotten.

A purely personal account is out of scope. It stops being personal the moment work files or work email run through it — at which point it belongs on the list like everything else.

The shared-responsibility line

The provider secures the platform: their servers, their software, their data centres. You are responsible for your configuration of your accounts — and that is what Cyber Essentials assesses. For everyday online tools that mainly means: MFA switched on for every user and every admin; only the accounts that should exist, with leavers removed promptly; admin rights held by the people who need them, tracked and reviewed; and features you don’t use switched off. Whether the service is Microsoft or a niche industry tool, those questions are the same. If you run your own virtual servers or platforms in the cloud (IaaS or PaaS), firewall, patching and malware duties are partly yours as well.

MFA is where cloud services decide the result

The four MFA questions (A7.14 to A7.17) are asked across your cloud-service list, and A7.15 to A7.17 are automatic fails: every admin and every user of every service that offers MFA must have it on, and listing a service as “no MFA available” when it actually offers it fails you on its own. Since nearly every mainstream service offers MFA, building the list at A2.9 is building your MFA to-do list. The MFA guide covers the accounts people forget; the MFA gap checker turns your tool list into the to-do list in a minute.

Building an honest service list

1. Sweep the obvious: email, files, accounting, CRM, comms — the tools everyone uses daily.
2. Sweep the money: online banking and any other portal holding business data count as cloud services too, so list them — along with payment platforms, payroll and pensions providers.
3. Sweep the marketing: the website’s admin login, the newsletter tool, every social account the business posts from.
4. Sweep the one-person tools: the design app one person uses, the scheduling tool, the e-signature service. One user still counts.
5. Check the leavers: for each service, who can actually log in today? Ex-staff access is a gap hiding inside a tool list.

Record the list in your asset register with a column for “MFA on for everyone?” — that single sheet answers A2.9 and prepares A7.14 to A7.17.

Two honest edge cases

A service run by your IT provider — if the account is your organisation’s, it is in scope even though someone else uses it, and their admin login needs MFA like yours. A tool with genuinely no MFA option — rare, mostly old niche software. First check whether it can sign in through Microsoft 365 or Google Workspace; if it can, that link must be set up and MFA comes from there, so it does not go on the A7.15 list. Otherwise, confirm it with the provider before you list it at A7.15, and ask whether the tool should stay at all; the assessor may wonder the same.