End-user device (EUD)
An end-user device is any computer, tablet, phone or thin client that a person uses directly to do their work. Cyber Essentials will not accept a scope that leaves these devices out. They are listed with make and operating system at A2.6, A2.6.1 and A2.8, and all five technical controls apply to them.
- Term
- End-user device
- Also known as
- EUD, End user device, User device
- Category
- Devices and software
- Requirement area
- B. Definitions; D. Scope
- Reviewed against
- Requirements v3.3
What does the term end-user device mean in Cyber Essentials?
An end-user device is any computer, tablet, phone or thin client that a person uses directly to do their work.
A scope that doesn’t include end-user devices isn’t acceptable.
How does end-user device apply to Cyber Essentials?
In plain terms
If a person sits in front of it or holds it in their hand to read email, open documents or use a business app, it is an end-user device. The office PC, the laptop that goes home at night, the finance manager's phone and the tablet in the warehouse all count. Servers, routers and firewalls are not end-user devices, because nobody uses them directly for their daily work.
What Cyber Essentials asks
The NCSC definition of devices names "end user devices such as desktop computers, laptops, thin clients, tablets and smartphones", whether physical or virtual. The scope section then adds the rule quoted above: you cannot certify without them.
The Danzell question set asks you to list them in three places: A2.6 for laptops, desktops and virtual desktops, A2.6.1 for thin clients, and A2.8 for tablets and mobile phones. Each entry needs the make and operating system version, and for Windows the edition and feature version as well. Personal devices that reach organisational data or services are included under the BYOD rules.
Common mistakes
- Listing an operating system version the vendor no longer supports. That breaks the licensed and supported requirement behind A6.1.
- Leaving phones off the list. The A2.8 guidance says devices connecting to cloud services must be included.
- Forgetting that Cyber Essentials Plus tests a representative sample of end-user devices (the test specification calls them EUDs), so every build you run needs to meet the controls.
See the scope overview and BYOD scope rules. Related: devices, thin client, BYOD.
Related terms
- DevicesDevices, in Cyber Essentials, are all types of hosts, networking equipment, servers, networks and end user devices such as laptops, tablets and smartphones, whether physical or virtual.
- Thin clientA thin client is a simple, low-powered computer that mainly acts as a screen and keyboard for a virtual desktop running somewhere else.
- BYOD (bring your own device)BYOD, short for bring your own device, means staff using their own personal phones, tablets or computers to do work.
- Extended Security Updates (ESU)Extended Security Updates are a paid programme in which a vendor keeps sending security fixes for a product after its normal end of support.
- FirmwareFirmware is the software built into a piece of hardware, such as a router or firewall, that makes the hardware work.
- HypervisorA hypervisor is the software that lets one physical computer run several virtual machines at once, sharing out its processor, memory and storage.
Frequently asked questions
An end-user device is any computer, tablet, phone or thin client that a person uses directly to do their work. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, end-user device comes up at A2.6, A2.6.1, A2.8. Read those questions against the definition above so your answers use the term the way the assessor will.
End-user device relates to B. Definitions; D. Scope in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.