What devices are in scope for Cyber Essentials?

Last updated: 27 September 2026

Cyber Essentials covers every device and service that can access your organisation’s data or connect to the internet on its behalf. If it handles work data, it is almost certainly in scope.

In scope

• End-user devices: desktops, laptops, tablets and mobile phones, including personal (BYOD) devices used to access work email, files or apps
• Servers and virtual desktops: on-premises and cloud-hosted
• Network devices: firewalls and routers that control your internet connection
• Cloud services: Microsoft 365, Google Workspace, accounting software and other SaaS, IaaS and PaaS services you use
• User accounts: every account that can access in-scope systems, including admin accounts

Usually out of scope

• Personal phones used only for calls, texts or multi-factor authentication apps
• Guest Wi-Fi that is fully separated from your business network
• Parts of the organisation you exclude with a clearly defined boundary (these must be described on the certificate)

What does being in scope mean?

Every in-scope device must be supported and receiving security updates, with high-risk and critical patches applied within 14 days. It must also have secure settings and malware protection. Since April 2026, multi-factor authentication is required on all cloud services wherever it is available, and missing it can lead to an automatic fail. See our summary of the Cyber Essentials 2026 changes.

Not sure what is in scope? ABCOM will map your devices and services as part of our Cyber Essentials support.