Can I still exclude a development environment?

Yes, if it is fully segregated from production identity and network, and contains no live organisational data. State the exclusion clearly in your scope description.

Are personal phones used for MFA in scope?

No. A device used solely to receive MFA prompts is not in scope. The moment that device opens email or files, it becomes BYOD and in scope.

Do home routers need configuring?

Under Danzell, the ISP-supplied home router is out of boundary scope provided the home worker's device has its host firewall enabled and configured.

Does a sub-set scope still get the free insurance?

No. The free £25,000 IASME cyber insurance requires whole-organisation certification. Sub-set scopes do not qualify.

How do I describe scope for a cloud-first firm?

Name the legal entity, the identity provider (typically Microsoft 365 or Google Workspace), the in-scope cloud apps and any laptop fleet. Avoid network-only descriptions.

Danzell Scoping Rule Changes: What Is Now In-Scope

The default: whole organisation

IASME and the NCSC continue to prefer whole-organisation scope. A whole-organisation certificate is what unlocks the free £25,000 cyber insuranceand the strongest tender position.

Sub-set scope under Danzell

You can still certify a sub-set – for example a single product team or a regulated division. Danzell requires:

A clear network or identity boundary, not just an org-chart line.
No shared user accounts spanning the boundary.
No shared infrastructure that exposes the in-scope set to the excluded one.
The certificate explicitly states the sub-set scope.

Home workers

Home worker devices that access organisational data are in scope. Routers supplied by the ISP are out of scope for the boundary firewall control as long as the device's host firewall is enabled and configured. Danzell makes the wording on this clearer – do not assume "home router exclusion" means home workers are exempt.

BYOD

BYOD is in scope when the device accesses email, files or business apps. Mobile devices used only for MFA prompts remain out of scope. See our BYOD guide for the practical options.

Cloud services

Every cloud service that holds organisational data or authenticates users is in scope. Danzell sharpens the responsibility split between IaaS, PaaS and SaaS – see our Danzell cloud rules guide.

How to evidence scope correctly

A short scope statement naming the legal entity, sites, networks and cloud tenants.
A device inventory aligned to the scope.
A list of in-scope cloud services with their service model.