Are contractors and subcontractors in scope for Cyber Essentials?
If you use subcontractors, freelance workers, outsourced IT support, bookkeepers or site-based contractors, Cyber Essentials scope can quickly feel confusing.
The answer usually depends on three things: who owns the device, who owns the account, and whether that person can access your business data or cloud services.
This guide explains the difference in plain English, with practical examples for trades businesses and suppliers going for Cyber Essentials because a customer, council, insurer, supplier or main contractor has asked for it.
Are contractors and subcontractors in scope for Cyber Essentials?
If you use subcontractors, freelance workers, outsourced IT support, bookkeepers or site-based contractors, Cyber Essentials scope can quickly feel confusing. The answer usually depends on three things: who owns the device, who owns the account, and whether that person can access your business data or cloud services.
The bit most contractors need to understand
If you give a subcontractor a company laptop, tablet or mobile phone to use for your work, that device should normally be treated as part of your Cyber Essentials assessment.
If the subcontractor uses their own device, the device itself may not be included in your assessment scope. That does not mean it can be ignored. If it is used to access your emails, job files, drawings, accounts system, shared folders, client portals or cloud services, you should have a clear rule that says what security standard that device must meet.
The simple way to think about it is this: out of assessment scope does not mean out of responsibility.
Devices you own
Company laptops, desktops, tablets and mobiles used for business data should be included. This still applies if you lend the device to a contractor or subcontractor.
Accounts you own
Microsoft 365 accounts, email accounts, admin accounts, remote access accounts and cloud service accounts remain your responsibility, even if a third party uses them.
Devices they own
A subcontractor’s own laptop or mobile may be outside the Cyber Essentials assessment, but you should still set expectations before allowing access to your systems.
Common trade business examples
Cyber Essentials can feel written for office-based companies, but the same questions matter on building sites, in vans, at home, in shared workshops and on customer premises.
| Scenario | Likely Cyber Essentials position | What to do in practice |
|---|---|---|
| A subcontractor uses your company laptop to access email, drawings and job files. | In scope because it is your device. | Include it in your device list. Keep it patched, supported, protected and locked down. |
| A subcontractor uses their own laptop to log in to your Microsoft 365 account. | The device may be out of assessment scope. The account and cloud service still matter. | |
| Your bookkeeper uses their own laptop to access your accounting software. | Their device may be out of assessment scope, depending on the setup. | Make sure the accounting account has MFA and ask the bookkeeper to confirm their device meets your security requirements. |
| Your outsourced IT provider uses an admin account to support your systems. | Your account is in scope, even if the person using it is external. | Use named accounts, MFA, least privilege and remove access when no longer needed. |
| A subcontractor only receives drawings by email and does not log in to your systems. | Usually lower risk, but still worth controlling. | Be careful what is shared, avoid unnecessary personal data, and use secure sharing where appropriate. |
What should contractors and subcontractors agree to?
You do not need to make this complicated. The aim is to show that you have thought about how external people access your business data and that you have sensible rules in place.
Supported devices
Their laptop, tablet or mobile should still receive security updates from the manufacturer or software vendor.
Updates installed quickly
High-risk or critical security updates should be installed within 14 days of release.
Malware protection
The device should have suitable anti-malware protection enabled and kept up to date.
Separate admin use
Day-to-day work should not be carried out using an admin account where separate accounts are possible.
Strong sign-in
Devices and accounts should use suitable passwords, PINs, biometrics or MFA, depending on how they are used.
Access removed when work ends
Accounts, shared folders and cloud access should be reviewed and removed when the contractor no longer needs them.
Example contractor device wording
This is not legal advice, but it gives you a useful starting point for a subcontractor agreement, supplier onboarding form or information security policy.
Sample wording
When working with [Company Name], the contractor or subcontractor agrees to protect any company data, client information, project files, emails, drawings, logins and cloud services they are given access to.
Where the contractor uses their own device to access [Company Name] systems or data, they agree to keep that device suitably secured. This includes:
- using a supported operating system and supported software;
- installing high-risk or critical security updates within 14 days of release;
- using suitable anti-malware protection where required;
- protecting the device with a password, PIN, biometric lock or other suitable sign-in method;
- not sharing company accounts or passwords with anyone else;
- using multi-factor authentication where requested;
- telling [Company Name] quickly if a device is lost, stolen, infected or suspected to be compromised;
- returning, deleting or removing access to company information when the work ends.
Keep the wording practical. A signed agreement is useful, but it should match what you actually do. Cyber Essentials is not about having paperwork for the sake of it. It is about being able to explain your setup honestly.
A simple way to prepare your Cyber Essentials answer
Before you start the assessment, list the people and companies who can access your business data. Then split them into three groups.
1. People using your devices
These are usually the easiest to deal with because you can manage the device directly.
2. People using your accounts
These need careful access control. Use MFA, named accounts and remove access when it is no longer needed.
3. People using their own devices
These may sit outside the assessment scope, but you still need a sensible contractor device policy.
Contractor scope FAQs
Are subcontractors included as employees for Cyber Essentials?
They may need to be counted when describing the people who work for or support your organisation, especially if they access your organisational data. That does not automatically mean every device they own is included in your assessment scope.
Do I need to list every subcontractor’s personal laptop?
Usually not if the laptop is owned by the subcontractor and not by your organisation. You should still have a way of confirming that any device accessing your data or services is suitably secured.
What if a contractor uses one of our Microsoft 365 accounts?
The account is yours, so treat it as in scope. Use MFA, avoid shared accounts, give only the access needed, and remove the account or permissions when the work ends.
What if we use outsourced IT support?
Accounts used to manage or support your infrastructure still need to meet Cyber Essentials controls. You should be able to explain how those accounts are protected.
Can we just exclude subcontractors from Cyber Essentials?
Not really. You can define the assessment scope correctly, but you still need to think about who can access your data, services and accounts. The assessor will expect a clear, honest answer.
Going for Cyber Essentials because a contractor, council or main contractor has asked for it?
We help trades businesses understand the questions, tidy up the obvious gaps and prepare sensible answers without turning it into an IT essay.