Buyer guide
Cyber Essentials Cloud Services in Scope: v3.3 Guide
Short answer
If an organisation's data or services are hosted on cloud services, current v3.3 guidance requires those relevant cloud services to be considered in scope; they cannot simply be excluded because a supplier hosts them.
Cloud-scope preparation
- List the services.Microsoft 365, Google Workspace, SaaS applications, hosted infrastructure and remote administration platforms.
- Define responsibility.Record what the supplier secures and what your organisation still configures: users, MFA, permissions, devices and tenancy settings.
- Check internet-accessible accounts.Review authentication and MFA requirements for user and administrator access.
- Document exclusions.Where something is genuinely outside scope, record why and how it is segregated.