Cyber Essentials scope: what’s in, what’s out, and five worked examples

What “scope” means

Your scope is the set of devices, networks and cloud services that the certificate will cover. The assessor judges the five controls — what Cyber Essentials actually asks for — against that set and nothing else, so the questionnaire begins (section A2) by asking you to describe it: is it the whole organisation or part of it, where does your team work from, what routers and firewalls do you have, what laptops and phones, any servers, and which cloud services. The answers become your scope statement and your asset list.

For most small businesses the right answer is “the whole organisation”. It is the simplest to describe, the simplest to defend, and it is what clients assume when they see the certificate. A partial scope — certifying one office or one team — is allowed, but it has to be a clearly separable part of the business with its own network boundary, and the certificate then only covers that part.

A worked example scope statement

This is what a finished statement looks like for a typical eight-person business — the same shape the scope statement builder writes from your own answers, and the shape the app’s Scope Statement document uses. Every device and service it names must also appear in the asset register; put your real operating-system versions where the placeholders are.

Scope Statement — Example Joinery Ltd. As recorded [date]. Whole organisation.

Who and where. Eight people at Example Joinery Ltd. One office location, with some of the team also working from home over their own broadband (their home routers are not business-owned and sit outside formal scope; each device’s software firewall is relied on).

Network equipment. One BT Business Smart Hub at the boundary.

Devices. Six Dell Latitude laptops (Windows 11 — version from Settings → System → About); two Apple MacBook Pro (macOS — version from About This Mac); eight personal phones used for work email — five Apple iPhones (iOS — current version) and three Samsung Galaxy (Android — current version). Personal devices used for work email or files are in scope and meet the same rules; personal devices used only for the phone’s built-in calls and texts, or two-factor codes, are excluded, per the scheme’s rules.

Servers. None — no servers, virtual servers or hosted desktops.

Cloud services. Microsoft 365, Xero, HubSpot, Slack, Canva, Facebook and Instagram business accounts. All cloud services holding business data are in scope, including business social-media accounts; none are excluded.

The itemised list behind this statement is our Asset & Cloud-Service Register, which we update when devices are replaced or new services are added.

Company, router and tool names are illustrative, not recommendations. Four more statements for other shapes of business — sole trader, fully remote, two sites, outsourced IT — are further down.

The rules that decide what is in

Every end-user device that touches work data

Laptops, desktops, tablets and phones used for work are in scope — with their make and the exact operating-system version, because the version decides whether the device counts as supported. A scope with no end-user devices at all is not valid; you cannot certify “just the cloud”.

Personal devices (BYOD)

A personal phone or laptop is in scope if it accesses work email, files or data. It is out of scope only if it is used only for the phone’s built-in calls and texts, or two-factor codes. So the owner’s own iPhone with the work mailbox on it is in — and must meet the same rules as a company phone: supported OS, updates, a lock screen, and only official-store apps that are on your approved list.

Cloud services

Cloud services cannot be excluded from scope if they store or process business data. That is your email and calendar, accounting software, file storage, CRM, project tools, payment platforms — and business social-media accounts, which the IASME question set (A2.9) treats as cloud services. How each one is configured, especially whether MFA is on, is your responsibility even though the service belongs to someone else.

Routers, firewalls and home workers

Any router or firewall your business owns is in scope, including the one your internet provider supplied — you will be asked for make, model and quantity. For people working from home, a router the business supplied is in scope; the home worker’s own broadband router is not, and instead you rely on the software firewall on their laptop. You will be asked how many home or remote workers you have and how they connect (home router, company router, or VPN).

Servers

If you have a server, a virtual server, a hypervisor or hosted desktops, they are in. Most businesses of five to fifty people have none.

Third parties and outsourced IT

Accounts that belong to your organisation but are used by a third party — an IT support company with an admin login, for example — are in scope. The login is yours even if the person using it is not.

Five worked scope statements

The scope statement is a short description, not an essay. These are illustrative examples for typical small businesses — adapt the details to yours, put your real operating-system versions where the placeholders are, and make sure every device and service it mentions appears in your asset list. Router models and tool names are examples, not recommendations.

1. Sole trader, one laptop, one phone

Whole organisation. One self-employed consultant working from home. Devices: one laptop (Apple MacBook Air, macOS — version from About This Mac) and one personal Apple iPhone (iOS — current version) used for work email. Network: home broadband router, not owned by the business; the laptop’s built-in firewall is relied on. No servers. Cloud services: Google Workspace, Xero, Dropbox, LinkedIn.

2. Eight-person office with personal phones

Whole organisation. One office at [address], eight staff. Network: one BT Business Hub router at the boundary. Devices: six Dell laptops (Windows 11 — version from Settings → System → About), two Apple MacBook Pro (macOS — version from About This Mac), eight personal phones used for work email — five Apple iPhones (iOS — current version) and three Samsung Galaxy (Android — current version). No servers. Cloud services: Microsoft 365, Xero, HubSpot, Slack, Canva, Facebook and Instagram business accounts.

3. Fully remote team

Whole organisation. No office; twelve staff working from home across the UK, connecting over their own broadband. No business-owned routers; each laptop’s software firewall is relied on. Devices: twelve company laptops (Windows 11 — version from Settings → System → About), twelve company Apple iPhones (iOS — current version). No servers. Cloud services: Google Workspace, QuickBooks, Notion, Zoom, Mailchimp, LinkedIn.

4. Office plus a workshop on a separate network

Whole organisation. Two sites: an office at [address] and a workshop at [address], each with its own internet connection and router (Draytek Vigor 2865 and a Virgin Media Hub 5). Devices: five laptops (Windows 11 — version from Settings → System → About), one desktop in the workshop (Windows 11 — version from Settings → System → About), six company Samsung Galaxy phones (Android — current version). No servers. Cloud services: Microsoft 365, Sage, Tradify.

5. IT managed by an outside provider

Whole organisation. One office, fifteen staff. IT is managed by [provider], who hold an administrator account on Microsoft 365 and on the firewall; both accounts are in scope. Network: one Ubiquiti Dream Machine at the boundary. Devices: fifteen laptops (Windows 11 — version from Settings → System → About), fifteen personal phones used for work email — nine Apple iPhones (iOS — current version) and six Samsung Galaxy (Android — current version). No servers. Cloud services: Microsoft 365, Xero, Pipedrive, DocuSign, LinkedIn.

Mistakes that cause trouble later

• Leaving out the personal phones. If staff read work email on their own phones, those phones are in scope. Listing them honestly is far better than an assessor asking.
• “Windows 11” without the version. The questionnaire asks for the specific version; whether it is still supported depends on it.
• Forgetting the social accounts. The business Facebook page and LinkedIn account are cloud services. They need MFA like everything else.
• Trying to exclude an old machine. You cannot simply leave an unsupported laptop off the list while it is on your network with internet access. It has to be upgraded, replaced, or genuinely walled off.
• Excluding a cloud service because it belongs to someone else. It doesn’t matter who runs it; if it holds your business data it is in.

Once the scope is right, try the free nine-question check: four of its questions are automatic fails, it takes about two minutes, and nothing you answer leaves your browser.