Should a SaaS company put production in Cyber Essentials scope?

Usually no. CE is best suited to the corporate environment (staff laptops, identity, internal tools). Customer-facing production is better covered by SOC 2 or ISO 27001, which assessors and customers expect for that environment.

What about engineer laptops with production access?

Engineer laptops are corporate devices and must be in CE scope. They have to meet CE controls – MFA, supported OS, AV, patching. You can document that their privileged production access is governed separately under your SOC 2 or internal access policy.

Is GitHub in scope for a SaaS company doing CE?

Yes. GitHub (or GitLab/Bitbucket) is a corporate SaaS tool that holds organisational data – source code, secrets, internal docs. You must demonstrate MFA, account inventory and a leavers process for it.

Do early-stage SaaS startups need SOC 2 to do CE?

No. You can do CE without SOC 2. Just scope CE around the corporate environment and clearly state that production is excluded from this particular assessment. Many early-stage SaaS companies certify for CE first, then SOC 2 later.

What if my product runs in customer environments (single-tenant)?

If customer-deployed instances are managed by the customer's own staff and infrastructure, those are out of CE scope for you. If you remotely manage them, the access path (laptops, jumpboxes) is in scope but the customer's infrastructure usually is not.

Cyber Essentials for SaaS Companies

Why SaaS scoping is different

A typical SaaS company runs two distinct environments:

Corporate: staff laptops, identity provider, email, CRM, code repos, internal tools
Production: the AWS / GCP / Azure infrastructure that runs the product, holds customer data and is exposed to customers

These environments have different security models, different audit regimes and different risks. Cyber Essentials is best suited to the corporate environment. Production usually sits under SOC 2, ISO 27001 or specific contractual commitments to your customers.

The recommended scope for most SaaS companies

Scope CE around:

All staff laptops (founders, engineers, sales, support, ops)
The identity provider for staff (Google Workspace / Microsoft 365 / Okta)
Internal SaaS tools (Slack, Notion, Linear, Github, Figma, etc.)
Mobile devices used for work email or Slack
Office network if you have one

Exclude from CE scope:

Production AWS/GCP/Azure accounts (covered by SOC 2/ISO 27001)
Customer data within your product
Customer-facing infrastructure
Build pipelines that only deploy to production (caveat below)

The boundary problem: engineer laptops

The trickiest piece is engineer laptops. They sit in the corporate environment but they hold the keys to production. Most assessors are pragmatic: the laptop is in scope (so it must meet CE controls – MFA, supported OS, AV, patching), and you also document that the laptop's privileged access to production is governed separately.

What you must NOT do is claim engineer laptops are out of scope because "they only access production". Engineer laptops are clearly in-scope corporate devices.

How to describe the scope on your submission

Use a clear scope statement on the IASME questionnaire, something like:

"All staff laptops, mobile devices used for corporate communications, the corporate identity provider (Google Workspace), and internal SaaS tools used by [Company]. The customer-facing production environment hosted on AWS is excluded and covered separately under our SOC 2 Type II programme."

This is honest, defensible and accepted by IASME assessors.

What if you don't have SOC 2 yet?

Plenty of early-stage SaaS companies don't yet have SOC 2 or ISO 27001. That's fine – you can still scope CE around the corporate environment and clearly state that production is excluded from this assessment. Your customers will likely ask for a separate statement about production security; CE doesn't have to cover it.

The CE controls applied to a SaaS corporate environment

Firewalls

Software firewalls on every laptop. If you have an office, the office router/firewall too.

Secure configuration

No default admin passwords. Auto-lock on devices. Disk encryption (FileVault / BitLocker).

User access control

SSO via Google Workspace or M365. MFA enforced. Documented leavers process. Admin accounts separate from day-to-day accounts.

Malware protection

macOS built-in protections + Gatekeeper, or Defender on Windows. EDR like SentinelOne / CrowdStrike if you have it (not required, but a strong signal).

Security update management

Auto-update enabled on macOS, Windows Update for Business on Windows. Browser auto-update on. App store apps update automatically.

Common SaaS scoping mistakes

Trying to bring production into CE scope. CE isn't designed for it – use SOC 2 or ISO 27001.
Excluding engineer laptops. Engineer laptops are corporate devices and must be in scope.
Forgetting BYOD. Founders and salespeople often check work Slack on personal phones.
Forgetting GitHub/GitLab. Source control is a corporate SaaS tool and must be in scope.

Why SaaS companies bother with CE

CE is increasingly required by enterprise customers, UK public sector tenders and cyber insurers. It's a fast, cheap, well-recognised baseline – often the first security cert a SaaS company achieves. See Cyber Essentials for government contracts for procurement detail.