Cyber Essentials scope is the set of devices, networks and cloud services covered by your certificate. The NCSC says certification should cover the whole organisation to qualify for the bundled cyber insurance. A well-separated subset is possible, but it needs a defined boundary and agreement from your certification body.
Cyber Essentials is a UK government backed scheme developed by the NCSC and delivered by IASME. Both Cyber Essentials and Cyber Essentials Plus assess five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Scope tells you where those five apply.
What is the starting point?
The NCSC overview page we fetched on 18 October 2026 says whole-organisation certification is required for the free cyber liability insurance that IASME arranges for UK organisations with turnover under 20 million pounds. It gives no detailed scope rules. Detailed rules sit in the requirements document, which we could not fetch directly, so the points below come from IASME guidance surfaced in search and from secondary summaries. Confirm them in the current NCSC requirements before you apply, because the scheme has been updated over time.
Whole organisation or subset?
Per those sources, a subset must be well defined and separately managed, with technical separation between what is in scope and what is not. The scope statement should name the business unit, network boundary and location, and your certification body should agree it before assessment starts. If you cannot separate parts of your network, treat them all as in scope.
What typically falls inside?
- End-user devices. Secondary summaries say a scope that excludes end-user devices is not acceptable.
- Home and remote working. Company and personal devices used for work, including home working, are reported as in scope.
- Cloud services. A cloud service that holds your organisation's data cannot be excluded as a category. IASME says who applies a control depends on the type of service (for example, the provider handles more for software as a service), but your organisation stays responsible.
- Network equipment. Routers and firewalls at each location, including home routers if staff work from home on corporate devices, so check how the requirements treat them.
- Servers and virtual desktops. Anything running business software.
What does a scoping workshop look like?
Run it in one hour with IT and a leader:
- Draw each office, home working pattern and cloud account on one page.
- List every device type: laptops, phones, tablets, servers, network gear.
- List every cloud service used for business data and its admin owner.
- Mark which parts could be technically separated, and by what.
- Decide whole organisation or subset and write why.
How does scope affect the assessment?
The self-assessment questions are answered for your declared scope, and a board member or equivalent signs it off. For Cyber Essentials Plus, independent technical testing checks that controls work in practice on a sample from that scope, so a vague scope creates trouble at test time.
What to do
- Read the current NCSC requirements document and note the version.
- Build a device and cloud inventory before answering any question.
- Choose whole organisation unless you have real technical separation.
- Write the scope statement in two sentences, covering locations, units and boundary.
- Agree it with your certification body or the assessor you will use.
- Fix gaps in the five controls inside that scope, then submit.
Quick check
Can I leave personal phones out?
Not if they are used for business data, according to secondary summaries of the requirements. Check the current NCSC text for how mobile devices and personal devices are treated.
Does the whole organisation have to be in scope?
The NCSC requires whole-organisation certification for the bundled insurance. Otherwise IASME guidance allows a subset if it is well defined and technically separated.
How Safeguard helps automate this
Cyber Essentials is a controls check, and the inventory and patching evidence is what sinks most applications. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits. That leaves your team more time for other work. Technical evidence comes from real code and dependencies through scans, SBOMs and reachability. Autonomous remediation can open tested fix pull requests for vulnerable dependencies, off by default with every category on Manual until you choose. The assessor decides the result. Book a call to see it.
Sources
- NCSC: Cyber Essentials overview, fetched 18 October 2026
- IASME: Cyber Essentials scope, seen in search results only, not fetched
- Wikipedia: Cyber Essentials, secondary summary; verify against the NCSC requirements
Last reviewed: 18 October 2026.
