Step 1 of 7
Decide what's in scope and list everything
Cyber Essentials covers every device and online service that can reach your business data and the internet. Before you change any settings, you need to know exactly what that includes.
For a business of 1 to 10 people, the simplest and safest choice is almost always to include the whole organisation.
How to do it
Choose your scope
Include the whole organisation unless part of the business genuinely runs separately, on its own network with its own accounts. If you leave anything out, you'll need to explain what it is, why it's excluded and how it's kept apart.
List every device
Write down every laptop, desktop, phone, tablet, server, router and firewall, with its make, model and operating system version (for example, Windows 11 23H2 or iOS 18). If you use Microsoft Intune or Google Workspace, you can export most of this list from the admin console.
Include personal devices used for work
If someone reads work email on their own phone, that phone is in scope. Either bring it up to the same standard as company devices, or stop it reaching business data.
List every cloud service
Include Microsoft 365 or Google Workspace, your accounting software, CRM, file sharing, online banking, domain registrar and website host. Check your direct debits and card statements to catch the ones people forget. Under the current requirements, cloud services can't be left out of scope.
Think about home workers
Home broadband routers are usually out of scope, as long as each laptop runs its own firewall. That's covered in the next step.
Common reasons people get caught out
- Forgetting personal phones that get work email
- Missing small tools someone signed up to on their own
- Listing "Windows" without the version number
- Leaving part of the business out without real separation
Your checklist for this step
- Scope agreed: the whole organisation, or a justified part with its separation documented
- A list of every in-scope device, with make, model and operating system
- Personal devices used for work identified and included
- Every cloud service your business uses listed
- Home and remote working covered
This guide summarises Cyber Essentials Requirements v3.3 for small businesses. It is general guidance, not the official question set. Check the current requirements on the IASME website before you submit. Last updated 2 November 2026.