Cyber Essentials plus + "legacy" network segments

For customer reasons my org is looking to obtain Cyber Essentials Plus. We're not based in the UK and there are some differences between my local cyber security "accreditation" regime.

This leads me to "legacy" network segments... The bane of any manufacturing environment. They contain relics, modern systems with unhardenable configurations or unpatchable applications, mystery hardware appliances, and so on. The segments are firewalled at the boundary, minimal allow-lists, etc.

I'm reading that a "Scenario 2" de-scoping would be the order of the day here (As per here - https://ce-knowledge-hub.iasme.co.uk/space/CEKH/2708766742/Subset+Scoping+Guidance). The whole org would be in scope (which is desirable) and the internal firewalling should be segmentation enough.

The catch is around internet access. Some of the modern devices on these "legacy" segments are able to establish machine-specific white-listed connections through a proxy to do various things: Periodic software activation checks, cloud-based EDR and application allow-listing updates. They are technically blocked from direct outgoing internet access at the boundary (and gateway) and opening a web browser isn't going to get anywhere due to a limited whitelist. The local assessors recognise that the risk is mitigated to negligible due to these (and other) technical and policy controls.

Is this going to be a problem for CE+?

Impact

There is no direct security vulnerability or exploit described. The impact relates to compliance scope and risk assessment for Cyber Essentials Plus certification in environments with legacy network segments. The risk is considered negligible by assessors due to strict internal segmentation and controlled internet access via whitelisted proxies. No active threat or compromise is reported.

Defensive guidance

This is a compliance and network segmentation issue rather than a vulnerability requiring patching. The vendor (IASME) guidance suggests that internal firewall segmentation combined with minimal allow-lists and controlled proxy access sufficiently mitigates risk for Cyber Essentials Plus certification. Organizations should follow the official IASME subset scoping guidance and ensure internal segmentation and proxy controls are properly implemented and documented. No additional urgent remediation is indicated.

Summary

The content discusses Cyber Essentials Plus certification challenges related to legacy network segments that include unpatchable or hardened systems isolated by internal firewalls and strict allow-lists. The recommended approach is 'Scenario 2' de-scoping, keeping the whole organization in scope while relying on internal segmentation. Internet access is restricted to machine-specific whitelisted proxy connections for essential functions like software activation and cloud-based updates. Assessors view these controls as mitigating risk to negligible levels. This is a security compliance and network segmentation topic rather than a specific vulnerability or exploit.

Cyber Essentials plus + "legacy" network segments

Discussion

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 3 Jun 2026, 12:18 UTC

Technical details

References

Community reviews