A Remote Business
Five staff use company laptops, hosted email and cloud files. There is no shared office.
What to Do
List the laptops and cloud services. Working from home does not remove them from scope.
Your Cyber Essentials Scope
Your scope is the boundary of the organisation and technology being assessed. It tells the assessor what your answers cover.
Trace the Work, Not Just the Office
Start with the applicant: the legal organisation seeking certification. Follow how its people access work data and services.
Your Proposed Assessment Boundary
People and Places
Staff, volunteers and remote work
Work Devices
Computers, phones and servers
Cloud and Accounts
Email, files, apps and cloud
Who Manages Each Part?
You, a cloud provider or an IT company may share the work. Record the split of responsibilities; a provider’s location does not decide what is in scope.
What to Put on Your First List
Use these checks before deciding that something can be left out.
- Organisation
- Name the legal applicant and any other entities to be included. Sharing a brand does not automatically include every group company.
- Devices and Remote Work
- List computers, servers, phones, tablets, routers and firewalls. Organisation-supplied home routers are included; other home routers are excluded, but device firewall requirements still apply.
- Personal Devices for Work
- For staff, volunteers and trustees, a personal device accessing work data or services normally belongs in scope. A phone used only for built-in calls, texts or sign-in verification apps (multi-factor authentication, or MFA) is excluded; work email changes that answer.
- Cloud Services
- Include account-based services that store or process your organisation’s data: email, file storage, business apps and relevant social accounts. Record what you manage and what the provider manages.
- Contractors and Managed IT
- Third-party contractors’ and managed-IT administrators’ own devices are excluded under the current rules. Your organisation’s loan devices and accounts remain included. You must still confirm that excluded devices accessing your data or services are configured correctly.
- Proposed Exclusions
- A department name alone is not a technical boundary. Excluded network areas require a firewall or a virtual local area network (VLAN), which separates network areas. Software groups alone are insufficient. Confirm the proposed boundary with your certification body.
CE and CE+ must cover the same scope. Outsourcing IT does not transfer the applicant’s responsibility for its declaration.
See How the Boundary Changes
Three fictional situations. Each has a different check to make.
A Charity With Personal Phones
Trustees read charity email on their own phones. Another volunteer uses a phone only for a sign-in verification app.
What to Do
Record the different uses. Email access normally brings a personal phone in; the app-only phone fits the stated exception.
A Business With Outsourced IT
A provider uses its own laptop to administer the business’s cloud account.
What to Do
Check the provider-device rules separately. The business’s cloud account and its responsibilities still need to be covered.
Not Sure Who Owns a Laptop?
A staff member accesses work email on a laptop, but nobody can confirm who owns or manages it.
- Owner
- Applicant’s person responsible for IT, such as the business owner or a trustee
- Next Action
- Ask the user and provider for ownership, management and work-access details. Keep the question open until its treatment is confirmed; do not silently leave the laptop out.
Five Steps to a Clear First Scope
- Name the applicant and required certificate level.
- List work devices, services, locations and relevant people.
- Record who manages each item and can provide evidence.
- Give every unknown an owner and a next action.
- Agree the boundary and exceptions with the certification body.