Danzell A2.1

Is this assessment for your whole organisation or only a part of it?

Section A2: Scope of Assessment · Cyber Essentials Danzell

Danzell tightened the definition of a valid partial scope: sub-sets must be technically enforced, not merely documented.

What this question is really asking

This is the foundational scope question. A whole-organisation scope is often simpler to certify but requires all devices and services to meet the standard. A partial scope is acceptable but requires you to clearly define and technically enforce a boundary — assessors scrutinise partial scopes rigorously.

What satisfies this requirement

Select the applicable option

Whole organisation includes all networks, user accounts and devices accessing organisational data. Partial organisation means some networks are excluded using a firewall or VLAN.

Check how you answer this in the CE Explorer

Free tool — all 288 questions mapped across every CE version.

Open CE Explorer

What to prepare before your assessor visit

This is the single most consequential decision in the application. Whole-organisation scope is straightforward to describe but can be harder to pass if any corner of your organisation isn't compliant. Partial scope can protect you from failing on one awkward part of the business, but the boundary must be technically watertight — assessors will probe it carefully. Think before choosing partial scope; the documentation and technical enforcement burden can be considerable.