Which devices count for Cyber Essentials?
Cyber Essentials scope can feel simple until you start listing the kit your business actually uses.
There’s the office laptop. The mobile used for email. The tablet in the van. The home computer used to check quotes. The Microsoft 365 account your bookkeeper logs into. The old PC in the corner that still has access to customer files.
This page helps you work out which devices, accounts and cloud services need to be considered before you start your Cyber Essentials assessment.
What devices are in scope for Cyber Essentials?
This is one of the first places Cyber Essentials gets confusing. It is not just about the computers in your office. If a device can access your business data, emails, cloud services or systems, you need to think carefully about whether it belongs in your assessment scope.
Start with the data, not the device
A useful question is not “is this a company laptop?” It is “can this device access our organisational data or services?”
Organisational data could include emails, quotes, drawings, invoices, customer details, supplier records, payroll information, photos from jobs, cloud files or project documents.
Organisational services could include Microsoft 365, Google Workspace, accounting software, remote desktops, customer portals, CRM systems, file-sharing tools, cloud backup portals and business social media accounts.
If the device accesses those things, it probably needs to be considered.
Devices in the office
Desktop PCs, laptops, servers, routers and firewalls used by the business are normally part of the Cyber Essentials conversation.
Devices on site or in vans
Mobiles, tablets and laptops used to check email, access job sheets, send invoices or open drawings may be in scope.
Devices at home
Remote working devices still matter. Working from the kitchen table does not automatically move a device outside Cyber Essentials.
Quick guide: what is usually in scope?
Cyber Essentials depends on your actual setup, but this table gives a practical starting point for trades, contractors and small businesses preparing an assessment.
| Device or service | Usually in scope? | Plain English reason |
|---|---|---|
| Company laptops and desktops | Yes | They access your business data, emails, files and cloud services. |
| Employee-owned laptops used for business work | Yes | BYOD devices can be in scope when they access organisational data or services. |
| Company mobiles and tablets | Yes | If they access email, calendars, business apps, photos, files or cloud services, include them. |
| Personal mobile used only for MFA | No | Devices used only for MFA apps, native calls or native texts are usually out of scope. |
| Servers, virtual servers and hypervisors | Yes | Servers provide business data or services to other devices. |
| Thin clients and virtual desktops | Yes | They are used to connect to organisational data or services, even if most work happens remotely. |
| Routers and firewalls | Yes | They control the flow of data between your network and the internet. |
| Home routers owned by staff | No | Home routers are generally not listed, unless the organisation provides the router. |
| Microsoft 365, Google Workspace and other cloud services | Yes | Cloud services cannot be excluded when they store or process organisational data. |
| Social media accounts used for the business | Yes | Business social media accounts are treated as cloud services in the question set. |
| Contractor-owned devices | It depends | They may sit outside the assessment scope, but your accounts, data access and contractor controls still matter. Read the contractor scope guide . |
What information do you need to collect?
You do not usually need serial numbers, MAC addresses or lots of technical detail. For most user devices, the Cyber Essentials question set is looking for a clear summary of what you use.
A simple device list for Cyber Essentials
Before starting the assessment, create a simple list. This avoids guesswork and helps you answer the scope questions with confidence.
Laptops and desktops
Quantity, make and operating system. For Windows, include the edition and feature version where possible.
Mobiles and tablets
Quantity, make and operating system version for devices that access business data or cloud services.
Servers and virtual servers
Quantity and operating system, including virtual server hosts and virtual desktop infrastructure where used.
Routers and firewalls
Make, model and quantity of the equipment that controls traffic to and from the internet.
Cloud services
List the services you use, including Microsoft 365, Google Workspace, accounting software, cloud storage and business social media.
Remote workers
Note how people connect to business data and services, including home broadband, VPN or cloud-based access.
Keep it honest and practical. A small trades business does not need an enterprise asset register, but it does need to know what devices and services are being used for work.
Common mistakes we see
“It’s only a phone”
If that phone accesses email, files, customer messages or job photos, it may be more than “just a phone” for Cyber Essentials.
Forgetting cloud services
Microsoft 365, Google Workspace, Dropbox, Xero, QuickBooks and similar services should not be treated as separate from scope.
Ignoring old kit
Old laptops, unsupported operating systems and forgotten devices can cause problems, especially if they still access business systems.
Device scope FAQs
Are personal phones in scope for Cyber Essentials?
They can be if they access organisational data or services, such as business email, calendars, files, job management apps or cloud systems. If the phone is only used for native calls, native texts or MFA apps, it is usually out of scope.
Do we need to include home routers?
Usually no. Home routers are generally not listed unless the organisation has provided the router. Remote workers still need suitable protection on the devices they use, such as software firewalls.
Are Microsoft 365 and Google Workspace in scope?
Yes. If they store or process your organisational data, they are cloud services and should be included in your Cyber Essentials scope.
Do we need to include switches and wireless access points?
Not usually if they do not contain a firewall and do not route internet traffic. Routers and firewalls that control traffic to and from the internet do need to be listed.
Are contractor devices in scope?
Devices owned by contractors may be outside the assessment scope, depending on the setup. Company-owned devices loaned to contractors should normally be included. Your accounts and cloud services still need protecting.
We cover this in more detail in our guide: are contractors and subcontractors in scope for Cyber Essentials?
Can we pass Cyber Essentials without including any end-user devices?
No. A scope that does not include end-user devices is not acceptable. Laptops, desktops, mobile devices, tablets or virtual desktops used to access organisational data or services need to be considered.
Not sure what to include in your Cyber Essentials assessment?
We help trades, contractors and small businesses work out their scope, tidy up the obvious gaps and prepare clear answers without turning it into a technical headache.