Under Cyber Essentials v3.3, Microsoft 365 and your other cloud services are firmly in scope. Here's a practical asset check covering users, devices, guests and admin accounts to do before your next renewal.
For many small businesses, "our systems are in Microsoft 365" can sound like the end of the security conversation. In practice, it's the point where the conversation needs to get more specific.
The NCSC's Cyber Essentials Requirements for IT Infrastructure v3.3, which applies from April 2026, says cloud services that hold your organisation's data or run its services must be in scope, and it uses Microsoft 365 as an example of software as a service (SaaS).
That doesn't mean you're expected to run Microsoft's data centres or patch Microsoft's servers. It does mean you're responsible for the parts you control: who can sign in, which devices can reach your information, how the service is configured, and whether access is removed when it's no longer needed.
The same goes for your other cloud platforms: file sharing, CRM, finance software, hosted phones and online project tools.
A software list might say "Microsoft 365, accounts package, CRM and backup". A useful asset review asks better questions:
Cyber Essentials v3.3 describes asset management as a core security function that supports all five technical controls, even though it isn't one of the five itself. That's the right way to think about it: the list isn't paperwork for its own sake. It should help you make better decisions about firewalls, configuration, updates, access and malware protection.
You don't need a perfect catalogue on day one. Start with the assets most likely to affect continuity or expose sensitive information.
Write down your Microsoft 365 tenant and every other cloud platform the business relies on. Include the owner, supplier, purpose, renewal date and the type of information held there.
Be specific. "Microsoft 365" is a starting point, but SharePoint, OneDrive, Teams, Exchange Online and Entra ID can each have different settings, owners and access patterns.
Export or review your current user list and look for:
Cyber Essentials v3.3 expects accounts to be removed or disabled when they're no longer required, including after someone leaves or after a set period of inactivity. Our employee offboarding checklist covers the leaver side in detail, and too many admin accounts is one of the most common gaps we find.
Record the action, owner and date for anything that needs fixing. A short, trackable list of improvements is worth far more than a long report.
List company laptops, desktops, phones and tablets, then identify any personal devices used for work. Note who owns each one, who uses it, whether it's still supported, and whether it can be locked or wiped remotely if needed.
Microsoft's security guidance for businesses with up to 300 users recommends protecting every device that accesses company data, personal or company-owned, using device management, multi-factor authentication and, where available, Conditional Access.
This is where a vague BYOD policy becomes a practical decision. You might allow personal phones to read email but not download sensitive files, or require an approved app and a screen lock. The right answer depends on the information and how your team works.
For each important service, ask whether:
Don't treat a green dashboard or a high Secure Score as proof that everything is safe. Use those tools to find actions, then confirm the settings fit the way your team really works.
Once you have the list, split the findings into three groups:
Keep the evidence proportionate. A dated asset list, an access review, a device register and a short record of what you've fixed will make your next assessment much easier, and it lets your IT provider focus on the real gaps instead of rebuilding the picture from scratch. If you're preparing for certification for the first time, our Cyber Essentials prep checklist walks through the rest.
Cyber Essentials isn't a substitute for sensible day-to-day security, and your certification body has the final say on scope. But v3.3 is a useful prompt for any business that has grown quickly in the cloud.
Set aside an hour this week with someone who understands the business, not just the technology, and walk through your Microsoft 365 users, devices, cloud services and suppliers. Give every item an owner and a next action.
If the list turns up unknown accounts, unmanaged devices or services nobody owns, that's useful information, not a failure. Managed IT Support can help turn it into a practical plan. Book a free IT review or email hello@managedtech.uk and we'll go through it with you.
The goal isn't a perfect spreadsheet. It's a clear view of what your business depends on, who can reach it, and what needs attention before a renewal, incident or urgent change exposes the gaps.
Book a free IT review and we'll show you exactly where your current setup is costing you money, leaving you exposed, or slowing your team down. No obligation, no hard sell.
