Answering the organisation and scope questions (A1 and A2)

The organisation and scope questions decide what your certificate covers. Get them right first, because every later answer is checked against them. In short: certify one named legal entity (listing any others it covers), count everyone who can reach your data, and list every type of device, operating system version, network device and cloud service in scope.

Your Certification Body marks the real submission. This is Apexward's guidance from public sources.

Section A1: your organisation

These questions identify who is being certified.

• Name (A1.1). One legal entity, exactly as registered. It appears on the certificate. You can add a trading name.
• Other legal entities (A1.6). If subsidiaries or sister companies share the same network and the same person can sign for all of them, list them here. Entities you leave out cannot be added after certification. If they have separate networks or separate signatories, they need their own assessments.
• Employee count (A1.3). Count everyone who works for you and can access organisational data, including volunteers, agency staff and contractors. This number also sets your fee band, and assessors compare it with your device counts.
• Registration number, addresses and sector. Use the registered number with no spaces, the registered address, and any operating addresses. Home workers' addresses are not needed.
• Requirements document (A1.11). You are asked whether you have read the NCSC requirements. Read them before you answer the rest.

Section A2: scope

Whole or part of the organisation (A2.1 to A2.2.2)

Whole organisation means all networks, user accounts and devices that reach your data and services. A partial scope is only possible by segregating a network with a firewall or VLAN. User groups, security groups, micro-segmentation and per-device firewall rules do not create a valid boundary. If you go partial, describe what is in scope (the description is visible through the certificate platform), what is excluded, and how the separation is achieved. Development and test networks must be kept out and separated in the same way.

Two things can never be excluded: cloud services, and the devices your staff use, including their own devices if they reach organisational data.

Networks and home workers (A2.3 to A2.4.2)

List each in-scope network by name, location and purpose, for example "Head office LAN, Leeds, staff and printing". No IP addresses. Give the number of home or remote workers, which includes anyone allowed to work remotely at all, and say how they connect: home router, a router you supply, or a corporate VPN.

Network equipment (A2.5 and A2.5.1)

List the make, model and quantity of every router and firewall that controls internet traffic. Leave out switches and access points that do not route or filter traffic, and leave out home routers you did not supply. If home workers rely on the device's software firewall, say so in the notes. For a partial scope, list the equipment that creates the sub-set. An operating system's built-in firewall cannot define the scope boundary.

End-user devices and servers (A2.6 to A2.8)

Give the quantity, make and operating system version for laptops, desktops, virtual desktops, thin clients, servers, hypervisors, phones and tablets. Models are no longer required. For Windows, give the edition and feature version, for example "20 Dell laptops, Windows 11 Pro 25H2". For Macs, give the macOS version. Include BYOD devices. A scope with no end-user devices is not acceptable.

Cloud services (A2.9)

List every third-party cloud service your organisation uses with an account: email and office suites, file sharing, accounting, CRM, HR, payroll, password managers, hosting, and social media accounts. IaaS, PaaS and SaaS all count.

Responsible person (A2.10)

Name the person responsible for your IT. They must be a member of your organisation, not someone employed by your IT provider.

What assessors typically query

• Windows listed without an edition or feature version.
• Device counts that do not fit the number of staff.
• A cloud list that misses obvious services, such as the accounting package.
• Home workers declared but no mention of how their devices are firewalled.
• A partial scope with no boundary device listed.

Answers that fail

• Excluding cloud services or staff devices.
• Listing an operating system that is no longer supported, such as Windows 10 without Extended Security Updates.
• A sub-set created by anything other than a firewall or VLAN.

Before you answer

1. Build a simple asset list: devices, operating systems, network equipment, cloud services.
2. Decide whole or partial scope, and why.
3. Check every operating system on the list is still supported.

Related: whole organisation or a sub-set, cloud services in scope, personal devices and home and remote workers.