Cyber Essentials 2: find the real scope, including cloud and home working

Start with how information is accessed

Bring the brief from part 1, network diagrams, device-management exports, an identity export and a list of purchased cloud services. Ask finance about subscriptions and department managers about browser-based tools. You need an estate you can explain, including things IT did not buy.

For each business activity, trace a person to a device, an account, a service and the network path. A salesperson opening the CRM on a personal phone is an access path. So is a remote administrator connecting to cloud infrastructure. A diagram showing only the office firewall misses both.

The v3.3 requirements bring cloud services holding organisational data or services into scope; you cannot simply exclude them. End-user devices also cannot be excluded wholesale. Whole-organisation scope is the clearest starting point. A smaller scope needs a defensible boundary, separate management and effective segregation, agreed with the certification body. An organisation chart alone is not technical segregation.

Reconcile several imperfect inventories

In the fictional Merefield estate, purchasing records show 48 computers. Device management reports 46 recently active devices, while identity logs show another computer signing in. The missing two might be spares, retired machines or offline staff devices; the extra machine might be a replacement or BYOD. Do not choose whichever count gives the best compliance percentage.

Create one record per physical device with a stable identifier. Match serial numbers or management IDs, then investigate unmatched rows. Keep retired assets with retirement evidence rather than silently deleting them. Record operating system edition and version, ownership, primary user, last seen date, management method, support status and access to organisational services.

Cloud inventory needs a different row: service name, tenant/account identifier, business owner, user population, administrators, sign-in methods, MFA enforcement and shared responsibilities. Distinguish a supplier's platform maintenance from your responsibility for tenant settings and accounts. A supplier certificate does not prove that your users are protected.

Handle the awkward boundaries explicitly

Read the third-party device table in the requirements with your assessor for the actual arrangement. Organisation-owned devices used by third parties remain in scope. Do not turn the MSP-owned-device distinction into an exclusion for the administrator's account or for a company laptop loaned to a contractor. Ownership and use both matter.

For remote work, identify whether traffic actually passes through a corporate VPN and firewall or uses the local internet connection. Split tunnelling means different traffic can take different routes. Check the endpoint's protection on each relevant path; “VPN installed” is not evidence that all connections use it.

Agree exclusions before relying on them

If a legacy system is claimed to be a segregated subset, record its connections and how the boundary is enforced. A VLAN name is not enough: routing or shared services may reconnect it. Have a suitably skilled person verify the design safely, under an approved change or test plan. Do not experiment with production routing during the assessment call.

The scheme treats certain bespoke application components differently from publicly available commercial software, but supporting operating systems and infrastructure still need consideration. Take an application inventory and a concrete architecture to the assessor if this distinction matters. “We write software” is not a general exclusion from technical controls.

Record every proposed exclusion with the requirement relied on, the supporting evidence, the person who checked it and the assessor clarification. If the explanation depends on access being blocked, retain evidence that the block works. A written BYOD ban with successful personal-device sign-ins is a discovery finding, not a completed boundary.

Build a scope statement from the records

Illustrative working scope — not a certificate declaration:
Merefield Services' business IT supporting its consultancy operations, including its office and remotely used company endpoints, relevant BYOD, network equipment and cloud services identified in registers DEV-01 and CLD-01.
Open question: investigate the unmatched sign-in device before finalising counts.
Boundary evidence: diagram NET-01 and the access-path register.
Owner: internal coordinator. Review trigger: new service, acquisition or material access change.

Avoid freezing uncertain numbers into the final statement. First reconcile the registers, then agree the precise wording and reporting requirements with the certification body. Keep the final submission and its supporting inventories together so later Plus testing uses the same scope.

Completion test

Ask someone outside IT to choose a department and explain how its staff work from home. Follow that description through your records. Then choose a cloud bill and identify its owner, users and access controls. If either journey falls out of the inventory, scope discovery is not finished.

Leave this part with a reconciled population, an access-path diagram and an explicit list of questions for the assessor. Part 3 uses that population to check firewalls and secure configuration. New discoveries should update the register throughout the project, not wait for next year's renewal.

Check your understanding