Willow A2.1

Does the scope of this assessment cover your whole organisation?

Section A2: Scope of Assessment · Cyber Essentials Willow

Danzell tightened the definition of a valid partial scope: sub-sets must be technically enforced, not merely documented.

What this question is really asking

This is the foundational scope question. A whole-organisation scope is often simpler to certify but requires all devices and services to meet the standard. A partial scope is acceptable but requires you to clearly define and technically enforce a boundary — assessors scrutinise partial scopes rigorously.

What satisfies this requirement

Yes or No

Whole organisation includes all networks, people and devices accessing organisational data and services. Answering No excludes eligibility for free cyber insurance.

Check how you answer this in the CE Explorer

Free tool — all 288 questions mapped across every CE version.

Open CE Explorer

What to prepare before your assessor visit

This is the single most consequential decision in the application. Whole-organisation scope is straightforward to describe but can be harder to pass if any corner of your organisation isn't compliant. Partial scope can protect you from failing on one awkward part of the business, but the boundary must be technically watertight — assessors will probe it carefully. Think before choosing partial scope; the documentation and technical enforcement burden can be considerable.