Cloud services - Compass

This lesson helps the learner identify cloud services that are in scope for Cyber Essentials, including SaaS, PaaS, IaaS, hosting platforms, identity platforms, business applications, password managers, developer platforms and business social media accounts.

CE questionnaire questions: A2.9

What You'll Be Able to Do

By the end of this lesson, you will be able to:

create a practical cloud service inventory
distinguish SaaS from cloud-hosted infrastructure
identify cloud services used by staff
administrators
contractors and outsourced providers
flag services that need follow-up during the MFA and user access control modules.

Why This Matters

It explains why the cloud service inventory is essential for later MFA, administrator access, password, update and access-control answers.

The most common problems are:

listing only Microsoft 365 or Google Workspace;
forgetting finance, HR, payroll, CRM and project management systems;
forgetting password managers;
forgetting website hosting, DNS and domain registrar accounts;

The Core Rule

A2.9 is about cloud services in scope.

A cloud service is any internet-accessible service used to store, process, manage, access or administer organisational data, systems, accounts or communications.

Common Mistakes

listing only Microsoft 365 or Google Workspace;
forgetting finance, HR, payroll, CRM and project management systems;
forgetting password managers;
forgetting website hosting, DNS and domain registrar accounts;
forgetting social media and advertising admin accounts;
forgetting developer platforms such as GitHub, GitLab, Vercel or Azure DevOps;

Copy This

Work through the workbook activity for this lesson. Each question maps directly to the CE questionnaire.

Quick Checklist

Before moving on, make sure you can say yes to these:

[ ] Why is the cloud service inventory important?
[ ] Should the learner stop after listing Microsoft 365 or Google Workspace?
[ ] What is SaaS?
[ ] What is the difference between a SaaS service and a cloud-hosted server?
[ ] Why should social media accounts be considered?

Your Action

Do this now — it takes 10–20 minutes.

List every cloud service your organisation uses. Start with the obvious ones (Microsoft 365, Google Workspace, Dropbox) then ask each department. Add to Section A2.

Key Takeaway

If the cloud inventory is incomplete, the later Cyber Essentials answers are likely to be incomplete too.

Your Workbook Activity

Complete: Cloud service inventory

This covers questionnaire questions: A2.9

Next Lesson

In the next lesson: Who manages the IT: internal responsibility, outsourced providers and evidence ownership

Lesson 3.8 — Cloud services: SaaS, PaaS, IaaS and social media accounts