What systems are included in a Cyber Essentials certification scope?
A Cyber Essentials certification scope typically includes the devices, software, networks and cloud services that an organisation uses to access or provide business data and services. It should also account for relevant user accounts, internet gateways, servers, firewalls, routers and remote-access arrangements, with the scope clearly defining which systems are included or excluded.
The scope of a Cyber Essentials certification is the defined set of technology, users and services assessed against the scheme’s requirements. It should cover every part of the organisation’s environment that could provide a route to business information or services, rather than only the equipment located in the office.
End-user devices are normally included where they are owned, managed or used by the organisation to access business systems. This can include desktop computers, laptops, tablets and smartphones. Devices used by home workers or travelling employees may therefore fall within scope if they connect to organisational services or handle business information. Personally owned devices should not be treated as automatically outside scope if they are permitted to access the organisation’s data.
The scope should identify the operating systems, applications and security configurations on those devices. Cyber Essentials considers whether software is supported, security updates are applied, user privileges are controlled and suitable protection is in place. A device does not become irrelevant simply because it is used by one person or connects through a home network.
Servers and infrastructure can include physical servers, virtual machines, domain controllers, file servers, application servers, backup systems and other systems that support business operations. The relevant question is how each system interacts with the organisation’s network and information. A server located in a data centre or hosted by a third party still needs to be considered if the organisation administers it or relies on it to deliver an in-scope service.
Network equipment and security controls form part of the scope where they control or provide access to the environment. This may include:
- routers, switches and wireless access points;
- firewalls and other internet gateways;
- virtual private network gateways and remote-access systems;
- network management platforms; and
- segmentation or filtering controls used to separate systems.
Internet-facing services deserve particular attention. Public websites, remote desktop services, email gateways, VPN services, externally accessible applications and other exposed systems can create an entry route even when the main office network is well protected. They should be identified in the scope and matched to the organisation or supplier responsible for their configuration and maintenance.
Cloud services should be assessed according to the organisation’s use of them and the responsibilities retained by the organisation. Examples include hosted email, online file storage, customer relationship management platforms, cloud-hosted servers, collaboration tools and infrastructure delivered by a cloud provider. The provider remains responsible for parts of the underlying platform, but the organisation is still accountable for areas such as account security, access permissions, administrator accounts, authentication settings and the devices used to connect.
Where a supplier hosts an application, the certification scope should make the division of responsibilities clear. The organisation should not assume that a supplier’s security certification automatically covers its own users, configurations or endpoints. Supplier-managed components may need to be recorded as dependencies, while the organisation’s controls around those services remain within its own assessment.
User accounts and administrative access are also relevant to the scope. This includes ordinary staff accounts, privileged administrator accounts, service accounts and accounts used for remote access. The assessment should consider who can reach each system, what level of access they have and whether unused or unnecessary accounts have been removed. Third-party support accounts should be included where they can access in-scope systems.
Mobile working and remote access should be documented rather than treated as exceptions. The scope may need to cover VPN equipment, remote-access applications, managed laptops, cloud identity systems and the controls applied when staff connect from outside the organisation’s premises. The external network used for the connection is not necessarily managed by the organisation, but the connecting device and access mechanism still need to be considered.
An organisation can define a limited scope in some circumstances, but an exclusion must be genuine and defensible. Systems should not be left out merely because they are difficult to secure, inconvenient to document or connected to the same environment as systems being assessed. Any boundary should be technically enforced, with appropriate separation preventing excluded devices or networks from undermining the security of the certified scope.
A practical scope record should therefore list the relevant locations, network boundaries, device types, servers, cloud platforms, internet-facing services, remote-access methods and responsible suppliers. It should also state what has been excluded and why. Keeping this record aligned with asset inventories, network diagrams and supplier arrangements helps prevent omissions when staff, systems or services change.
S2 Technology Group can help organisations review their technology estate, clarify shared responsibilities and prepare a workable Cyber Essentials scope. The aim is to ensure that the certification reflects the systems through which the organisation operates, rather than an incomplete snapshot of its IT environment.
A Cyber Essentials scope must correspond to the organisation, business unit or service that is applying for certification. This becomes important where companies share technology. For example, a subsidiary may not be able to certify its own devices separately if it uses a parent company’s shared identity platform, network, email service or administrator accounts without a clearly enforced separation.
Before defining the boundary, identify any technology shared with other legal entities, contractors or group companies. The scope should explain:
- which organisation and locations are covered;
- which shared services support the environment;
- who controls the relevant security settings; and
- how separate environments are technically isolated where only part of a wider estate is being assessed.
This prevents a narrow certification scope from overlooking dependencies that can still provide access to the systems being certified. Where separation cannot be demonstrated, the connected service or environment may need to be considered as part of the certification boundary.
