What is in scope: home workers, personal devices and cloud services

Before you answer a single question, you need to decide what your Cyber Essentials assessment covers. That is called scope. This article explains how the requirements treat home workers, personal devices and cloud services, using the NCSC’s own definitions.

What scope means

The requirements document defines scope as the networks, hardware and software assets, and cloud services included in the assessment. Your assessment and certification should cover the whole of the IT infrastructure you use to carry out your organisation’s business, or, if necessary, a well-defined and separately managed sub-set.

Whichever you choose, you must define the boundary clearly: the business unit that manages it, the network boundary and the physical location. You must also agree the scope with the certification body before assessment begins.

The NCSC states that organisations choosing a scope covering their whole IT infrastructure get the strongest protection and maximise customer confidence. If you exclude parts, you will need to justify the partial scope to your assessor.

What the requirements apply to

The requirements apply to devices and software in scope that meet any of three conditions: they can accept incoming connections from internet-connected devices, they can make outbound connections to devices over the internet, or they control the flow of data between those devices and the internet. In practice, that covers the laptops, phones, servers, routers and software most small businesses use every day.

Two statements are firm. A scope that does not include end-user devices is not acceptable, and cloud services cannot be excluded.

Home workers

The default is that all corporate or personal home or remote working devices used for your organisation’s business are in scope. Two practical points follow from the document:

• If your organisation gives a home worker a router, that router is in scope. Other routers, such as one supplied by the worker’s internet provider, are out of scope, so you apply firewall controls such as a software firewall on the user’s device.
• If the home worker uses a corporate VPN, their internet boundary is your company firewall, or your virtual or cloud firewall.

Wireless devices are in scope if they can communicate with other devices via the internet. The document says the scheme is not concerned with attacks that can only be launched within the signal range of a wireless device.

Personal devices (BYOD)

User-owned devices that access organisational data or services are in scope, in addition to mobile or remote devices your organisation owns. Organisational data means any electronic data belonging to your organisation, such as emails, documents and financial data. Organisational services include the cloud applications and software you own or subscribe to, for example Microsoft 365 or Google Workspace.

There is a useful exception. Mobile or remote devices used only for native voice applications, native text applications or multi-factor authentication apps are out of scope. A phone that is only used to approve sign-ins, for instance, does not bring the whole phone into scope.

The document also has a table for other people who use devices. Employees, volunteers and trustees can use their own devices, which are in scope. Students are different: their own devices are out of scope. Devices owned by managed service provider administrators, contractors and customers are out of scope too, but the document says you remain responsible for confirming that any device interacting with your data and services is configured correctly. Devices your organisation owns and loans to a third party are in scope.

Cloud services

The requirements define a cloud service as an on-demand, scalable service on shared infrastructure, accessed over the internet through an account, which stores or processes your organisation’s data. If your data or services are hosted in cloud services, they must be in scope.

The document sorts cloud services into three types: infrastructure as a service, platform as a service and software as a service. The cloud provider takes on more of the controls as you move from the first to the last, but your organisation is always responsible for making sure all controls are in place. User access control stays with your organisation for all three types. Where the provider implements a control for you, you must make sure the provider has committed to it in contract clauses or in documents the contract references, such as security statements.

Accounts used by suppliers

All accounts your organisation owns are in scope, even when a supplier, contractor or managed service provider uses them to look after your systems. If someone else manages part of your infrastructure, you must be able to confirm that the technical controls are being met and show that in your answers.

Practical tips for deciding scope

• List every device that touches business data, including personal phones and home laptops.
• List every cloud service your organisation subscribes to or has an account on.
• Note which accounts are used by third parties.
• Decide whether you can certify the whole organisation. The NCSC overview says the insurance entitlement for UK organisations with turnover under £20 million applies to certification covering the whole organisation.
• Agree the scope with your certification body before you begin.

In short

Scope is the first decision in Cyber Essentials. Home and remote working devices, personal devices that reach your data, cloud services and accounts used by suppliers are all in scope by default, with a few clear exceptions. Define the boundary, write it down and agree it before you start.

How Vigil CE helps

Vigil CE helps you build your inventory of devices, accounts and cloud services in one place, so your scope boundary is clear before you start the questions. Each item is tracked against the controls, which makes it easy to see where your scope statement and your real setup agree.