Cloud services are always in scope

Every cloud service that holds or processes your organisation's data is in scope for Cyber Essentials, and Requirements v3.3 says plainly that cloud services cannot be excluded. You do not have to secure the provider's data centre, but you are responsible for making sure all five controls are in place, either by you or by the provider.

What counts as a cloud service

Version 3.3 added a definition. In plain terms, a cloud service is an on-demand, scalable service that runs on shared infrastructure and is reached over the internet. For Cyber Essentials it is one that:

• you sign in to with an account, which may be issued by your organisation or may simply be a business email address, and
• stores or processes data for your organisation.

That second point catches more than people expect. A free file-sharing, design or survey tool that a member of staff signed up to with their work email, and uses for work, is a cloud service in scope. So are your email, office suite, accounting package, CRM, payroll, website hosting and any virtual servers.

Common examples include Microsoft 365, Google Workspace, Dropbox, Xero, Salesforce, Amazon Web Services and Azure. The list is yours to build: the assessment asks you to name the cloud services you use.

Why they cannot be left out

Cloud accounts are reached from anywhere on the internet, so a stolen password is often all an attacker needs. That is why the scheme treats them as part of your estate rather than someone else's problem. The applicant is always responsible for the controls being in place. Some of them can be carried out by the provider, depending on the type of service. See the cloud shared responsibility model.

The control that matters most: MFA

Requirements v3.3 says authentication to cloud services must always use multi-factor authentication. Under the Danzell question set, IASME has confirmed that a cloud service which offers MFA in any form, but does not have it switched on, is an automatic fail (questions A7.14 to A7.17). Services that genuinely offer no MFA must be listed, and assessors check those claims. See MFA for cloud services.

What you are typically responsible for

• Accounts: a process to create and approve accounts, one account per person, leavers removed, separate admin accounts, and MFA on every account.
• Configuration: removing unused accounts and features, changing default settings that weaken security, and making sure users sign in before reaching data.
• For virtual servers and platforms: firewall rules (security groups), patching what you manage, and malware protection on servers you run.

For services where the provider does a control on your behalf, such as patching a SaaS application, you need to be able to show the provider has committed to it in its contract or documents the contract refers to.

What to do

1. Build a list of every cloud service used for business, including free tools signed up to with a work email. Check expense claims, single sign-on logs and browser saved logins.
2. Remove services nobody needs, and move work out of personal accounts.
3. For each remaining service, record its type (IaaS, PaaS or SaaS), who the admins are, and whether MFA is on for every account.
4. Turn on MFA everywhere it is offered, including paid add-ons and sign-in through another provider such as Microsoft or Google.
5. Keep links to each provider's security or shared responsibility documentation with your evidence.

The readiness checker asks which cloud services you use and checks MFA for each type.