Defining the scope for Cyber Essentials certification

What is in scope and what is not for Cyber Essentials?

As a Cyber Essentials scheme applicant, you will need to ensure that your organization meets all the requirements.

Our online portal will help you accurately define your scope.

Your Cyber Essentials assessment and certification can cover the whole IT infrastructure, or a sub-set. However you define your boundary, your devices and software will need to meet the following conditions:

• Accept incoming network connections from untrusted Internet-connected hosts
• Establish user-initiated outbound connections to devices via the Internet
• Control the flow of data between any of the above devices and the Internet

In addition to mobile or remote devices owned by your organization, user-owned devices that access organizational data or services are in scope. 

Wireless devices (including wireless access points) are in scope if they can communicate with other devices via the Internet.

If it is practicable to apply the requirements to Cloud services, these services are within the boundary of scope. Commercial web applications created by development companies (rather than in-house developers) and which are publicly accessible from the Internet are in scope by default.