Certifying the whole organisation or a sub-set

Your Cyber Essentials certificate can cover the whole of the IT you use to run the business, or a well-defined sub-set of it that is managed separately. The NCSC recommends whole-organisation scope because it gives the best protection. If you leave anything out, you must explain why to your assessor, and the part you leave out has to be properly cut off from the rest of your network.

What "scope" means

Scope is the set of networks, devices, software and cloud services that your assessment covers. Under Requirements v3.3 you must define the boundary clearly before the assessment starts: which business unit manages it, where the network boundary is, and the physical location. You agree that scope with your Certification Body.

Within the boundary, the requirements apply to any device or software that can accept connections from the internet, can make outbound connections over the internet, or controls the flow of data between those devices and the internet. In practice that covers almost every computer, phone, server and cloud service you use.

Two rules apply whatever you choose:

• End-user devices must be included. A scope with no laptops, desktops, tablets or phones is not acceptable.
• Cloud services cannot be excluded. If your data or services are hosted in the cloud, those services are in scope. See cloud services in scope.

Whole organisation

Whole-organisation scope means everything you use for business is assessed together. It is simpler to describe, it avoids arguments about segregation, and it gives customers the clearest assurance. It also matters for IASME's included cyber insurance, which is only offered to eligible organisations that certify their whole organisation. Check IASME's current eligibility terms if the insurance matters to you.

Using a sub-set

A sub-set is a part of the organisation whose network is separated from the rest by a firewall or a VLAN. You can use a sub-set to say what is in scope (for example, one business unit) or what is out of scope (for example, a lab network or a legacy system).

IASME's scoping guidance sets out what counts as real segregation. In summary:

• The separation must be enforced at the network level, by a firewall or VLAN working at OSI layer 2 or 3.
• User groups, permissions, micro-segmentation, per-device firewall rules, proxies and DMZs do not create a valid exclusion on their own.
• The scope description in your assessment must name what is excluded, so the certificate does not overstate what it covers.

Keeping "whole organisation" with an isolated segment

IASME's guidance describes one case where you can exclude a segment and still describe the scope as the whole organisation: the segment has all inbound and outbound internet traffic blocked. This is also the route for unsupported software you cannot remove yet. See unsupported software options.

What does not work

• Leaving out staff personal devices. Staff BYOD that reaches work data or services cannot be scoped out. See personal devices and BYOD.
• Leaving out home workers. Their devices are in scope by default. See home and remote workers.
• Excluding a cloud tenant because "the provider handles it". The service stays in scope and responsibilities are shared.
• Calling a group policy or a separate login a sub-set. Without network segregation it is not one.

What to do

1. List every site, network, device type and cloud service you use for business.
2. Decide whether anything genuinely needs to be excluded, and write down why.
3. For each exclusion, confirm it sits behind a firewall or VLAN that separates it from the in-scope network, and that in-scope users cannot reach organisational data through it.
4. Write a scope description that names the organisation, the boundary and every exclusion.
5. Agree the scope with your Certification Body before you submit. Whether a particular segregation design is acceptable is the assessor's judgement, so raise unusual designs early.

If you are unsure what your scope looks like, the readiness checker asks the scoping questions first and shows which controls then apply.