The scope statement builder
Answer plain questions about where people work and what they use, and get back the short scope statement the assessment expects — with the 2026 rules already applied in the wording: home routers excluded, BYOD stated properly, cloud services never left out. In your browser; nothing stored.
Build your scope statement
Whole-organisation scope, which is the normal answer for a small business. Everything stays in this page — nothing is stored or sent. Leave a field blank and the statement uses a sensible placeholder to replace later.
Scope Statement — Your company
As recorded today. Whole organisation.
Who and where. a small team at Your company. 1 office location(s), with some of the team also working from home over their own broadband (home workers' own broadband routers sit outside scope and each device's software firewall is relied on; any router the business supplies to a home worker must meet the same firewall rules).
Network equipment. The provider-supplied router at the boundary [add make and model] — confirm inbound connections are blocked by default and the admin password has been changed from the default before using this statement.
Devices. Listed in our asset register with make and exact operating-system version. Personal devices used for work email or files are in scope and meet the same rules; personal devices used only for the phone's built-in calls and texts, or two-factor codes, are excluded, per the scheme's rules.
Servers. None — no servers, virtual servers or hosted desktops.
Cloud services. Listed in our asset register. All cloud services holding business data are in scope, including business social-media accounts; none are excluded.
The itemised list behind this statement is our Asset & Cloud-Service Register, which we update when devices are replaced or new services are added.
Why the wording matters
Scope is where assessments go wrong quietly: not because businesses hide things, but because the rules about personal phones, home routers and cloud services are not guessable. A statement that says the right things — the home-router exclusion with the software-firewall reliance, the BYOD in-scope rule with its narrow exemption, cloud services including social accounts never excluded, an IT provider’s admin accounts counted as yours — tells the assessor you understood the requirements, before they read a single technical answer. The builder writes those sentences for you; the scope guide explains each rule and shows five finished examples.
What to do with the statement
- Replace the placeholders. Anything you left blank renders as a sensible placeholder — real makes, models and OS versions belong in the final version.
- Match it to your asset register. The statement is the prose summary; the register is the itemised truth behind it. Every device and service in one should be findable in the other.
- Keep it whole-organisation unless you genuinely have a separable part with its own network boundary — partial scope is an edge case worth human advice, not a template.
- Reuse it at renewal. Update the counts and versions and the statement serves every year.
Frequently asked questions
What is a Cyber Essentials scope statement?
A short written description of what your certificate covers: whole organisation or part, locations, network equipment, devices, servers and cloud services. It is the prose summary of your asset register, and the scope section of the questionnaire is built from the same facts.
Should I choose whole-organisation scope?
For almost every small business, yes — it is the simplest to describe and defend, and it is what clients assume the certificate means. This builder writes whole-organisation statements; partial scope is an edge case that deserves a conversation, not a template.
What rules does the builder apply for me?
The scope rules that catch people out: home workers’ own broadband routers sit outside formal scope with the device firewall relied on instead; personal devices used for work data are in scope with the calls-texts-MFA exemption stated; cloud services, business social accounts included, are never excluded; and an IT provider’s admin accounts on your systems are yours and in scope.
Is what I type stored anywhere?
No. The builder runs in your browser; nothing is sent to ReadyCert or saved after you leave.