Devices
Devices, in Cyber Essentials, are all types of hosts, networking equipment, servers, networks and end user devices such as laptops, tablets and smartphones, whether physical or virtual. A scope that does not include end-user devices is not acceptable. Devices are listed with quantities and operating systems at A2.5 to A2.8.
- Term
- Devices
- Also known as
- Endpoints
- Category
- Devices and software
- Requirement area
- B. Definitions
- Reviewed against
- Requirements v3.3
What does the term devices mean in Cyber Essentials?
Devices, in Cyber Essentials, are all types of hosts, networking equipment, servers, networks and end user devices such as laptops, tablets and smartphones, whether physical or virtual.
Devices includes all types of hosts, networking equipment, servers, networks, and end user devices such as desktop computers, laptops, thin clients, tablets and smartphones - whether physical or virtual.
How does devices apply to Cyber Essentials?
In plain terms
In Cyber Essentials, "devices" means almost anything that runs software and connects to a network: laptops, phones, servers, routers, virtual machines and the hosts that run them. If it is in scope, the five controls apply to it.
What Cyber Essentials asks
Section B defines the term broadly, as quoted above. Every requirement that says "all devices in scope" uses this definition, so a virtual desktop, a hypervisor host and an IaaS instance are devices in the same way a laptop is. The scope section adds that "A scope that doesn’t include end-user devices isn’t acceptable." User-owned devices that access organisational data or services are included; see BYOD.
Where each device goes in the question set
| Question | Devices | What to give | IASME example or rule |
|---|---|---|---|
| A2.5 | Routers and firewalls | Make, model and quantity | No IP addresses, MAC addresses or serial numbers; no home routers |
| A2.6 | Laptops, desktops, virtual desktops | Quantity, make and OS version, with Windows edition and feature version | "25 DELL laptops running Windows 11 Professional version 23H2" |
| A2.6.1 | Thin clients | Quantity, make and OS | Only those connecting to organisational data or services |
| A2.7 | Servers, virtual servers, hypervisors, VDI | Quantity and OS | "2 x VMware ESXI 8.0 hosting 8 virtual Windows 2019 servers" |
| A2.8 | Tablets and phones | Quantity, make and OS version | "Devices that are connecting to cloud services must be included" |
Common mistakes
- Listing models but not operating system versions, which the assessor needs to check support at A6.1.
- Forgetting virtual machines and the host underneath them.
- Leaving out phones that only have email on them. Email access is access to organisational data.
See the scope overview and asset management. Related: end-user device, hypervisor, servers.
Related terms
- BYOD (bring your own device)BYOD, short for bring your own device, means staff using their own personal phones, tablets or computers to do work.
- End-user device (EUD)An end-user device is any computer, tablet, phone or thin client that a person uses directly to do their work.
- HypervisorA hypervisor is the software that lets one physical computer run several virtual machines at once, sharing out its processor, memory and storage.
- ServersServers, in Cyber Essentials, are devices that provide organisational data or services to other devices as part of your organisation's business.
- End of support (end of life)End of support is the date after which a vendor stops releasing security fixes for a product, so any new flaws found in it stay open for good.
- Extended Security Updates (ESU)Extended Security Updates are a paid programme in which a vendor keeps sending security fixes for a product after its normal end of support.
Frequently asked questions
Devices, in Cyber Essentials, are all types of hosts, networking equipment, servers, networks and end user devices such as laptops, tablets and smartphones, whether physical or virtual. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, devices comes up at A2.5, A2.6, A2.6.1, A2.7, A2.8. Read those questions against the definition above so your answers use the term the way the assessor will.
Devices relates to B. Definitions in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.