Cyber Essentials Scope Statement Examples: What Should You Include?
Published 30 October 2026
What a scope statement is for
The scope statement appears with your certificate, so customers read it. It should let someone quickly understand what is covered. Behind it, your self-assessment lists the devices, users, networks and cloud services within that boundary.
The examples below are illustrations. Replace the organisation names and details with your own, and make sure the wording matches what you actually declare.
Example 1: whole organisation
"The whole organisation of Example Ltd, including all users, devices, networks and cloud services."
Best for most small and medium organisations. It is simple and gives customers the most confidence.
Example 2: multi-site organisation
"The whole organisation of Example Ltd, including offices in Derby and Leeds, remote workers, and all associated users, devices and cloud services."
Naming sites is optional when the whole organisation is in scope, but some buyers find it reassuring.
Example 3: remote-first organisation
"The whole organisation of Example Ltd, a remote-first business, including all staff, company and personally owned devices used for work, and cloud services including Microsoft 365."
Useful where there is no office network. Your answers still need to cover home-working devices and their firewalls.
Example 4: subset of the organisation
"The managed IT services division of Example Group Ltd, operating from its Nottingham office on a separate network segment, including its users, devices and cloud tenancy. Other Example Group divisions are not included."
Warning: a subset is acceptable only where the excluded part is properly segregated, for example by a separate network or VLAN with controlled access. Do not word a subset so it reads like the whole organisation, and do not present the certificate to customers as covering systems outside the boundary.
Example 5: cloud-heavy organisation
"The whole organisation of Example Ltd, including all users and devices, and cloud services including Microsoft 365, Xero, HubSpot and AWS."
You do not have to list every cloud service in the statement itself, but all cloud services that fall within the certified scope must be declared; for a whole-organisation scope this normally means the organisation's work cloud services. See Cyber Essentials and cloud services.
What to inventory behind the statement
| Area | What to list |
|---|---|
| Users | Number of staff, contractors and admin accounts |
| End-user devices | Laptops, desktops, tablets, phones, with operating system and version |
| Servers | Physical, virtual and cloud-hosted servers, with operating system |
| Networks | Office networks, firewalls, routers, VPNs |
| Cloud services | Every IaaS, PaaS and SaaS service used, including AI tools |
| Personal devices | Any BYOD devices that access organisational data or services |
Weak wording and how to improve it
| Weak | Problem | Better |
|---|---|---|
| "Example Ltd IT systems" | Unclear whether everything is included | "The whole organisation of Example Ltd" |
| "Head office" | Excludes remote workers and cloud without saying so | Whole organisation, or name the head office network explicitly as a segregated subset |
| "Corporate laptops" | Leaves out phones, servers and cloud services | Describe the organisation or business unit, not one device type |
| "All systems except legacy" | Excluded systems must be segregated, and the wording invites questions | Segregate legacy systems properly, then describe what is in scope |
Hosted desktop and MSP environments need extra care. See scope statements for hosted environments and bad vs good scope statements.