Hypervisor
A hypervisor is the software that lets one physical computer run several virtual machines at once, sharing out its processor, memory and storage. Cyber Essentials counts the host as an in-scope server: A2.7 asks you to list virtual server hosts (hypervisors) with their operating system, and the hypervisor must stay supported and patched.
- Term
- Hypervisor
- Also known as
- Virtual server host, Virtualisation host
- Category
- Devices and software
- Requirement area
- D. Scope; 3. Security Update Management
- Questions
- A2.7A6.1A6.4AUTO-FAIL
- Reviewed against
- Requirements v3.3
What does the term hypervisor mean in Cyber Essentials?
A hypervisor is the software that lets one physical computer run several virtual machines at once, sharing out its processor, memory and storage.
How does hypervisor apply to Cyber Essentials?
In plain terms
If virtual machines are flats in a converted house, the hypervisor is the building manager. It decides how much space each flat gets and keeps the tenants apart. It also holds the master key, so if an attacker takes over the hypervisor, every virtual machine on it is exposed. VMware ESXi and Microsoft Hyper-V are common examples.
What Cyber Essentials asks
A2.7 asks: "Please list the quantity of servers, virtual servers, virtual server hosts (hypervisors) and Virtual Desktop Infrastructure (VDI) servers. You must include the operating system." IASME's example is "2 x VMware ESXI 8.0 hosting 8 virtual Windows 2019 servers".
The hypervisor is software running on a device, so the normal rules apply. It must be licensed and supported (A6.1), its critical and high-risk updates must go on within 14 days (A6.4, an automatic fail if answered No), and its management accounts are covered by secure configuration and user access control. A2.5.1 also mentions virtual firewalls hosted on a hypervisor, where they are used to create sub-sets.
What an assessor looks for
- A hypervisor version the vendor still supports, backed by its published lifecycle.
- A changed default password on the host and its management console. A5.3 covers servers.
- Separate administrator accounts for managing the host, used only for admin work.
See the security update management requirements and question A2.7. Related: virtual machine, servers, virtual desktop infrastructure.
Related terms
- Virtual machine (VM)A virtual machine is a complete computer, with its own operating system, that runs as software inside another physical computer.
- ServersServers, in Cyber Essentials, are devices that provide organisational data or services to other devices as part of your organisation's business.
- Virtual desktop infrastructure (VDI)Virtual desktop infrastructure is a way of running staff desktops on central servers or in the cloud, so the user's own device only displays the desktop.
- Jailbreaking and rootingJailbreaking (on iPhones and iPads) and rooting (on Android) mean removing the maker's built-in restrictions so the owner can install anything and change system files.
- Licensed and supported softwareLicensed and supported software is software you have a legal right to use and that a vendor supports with regular vulnerability fixes until a published end date.
- Long-term support (LTS)Long-term support is a version of a product that the vendor commits to keep fixing for several years, rather than the shorter period a normal release gets.
Frequently asked questions
A hypervisor is the software that lets one physical computer run several virtual machines at once, sharing out its processor, memory and storage.
In the 2026 Danzell question set, hypervisor comes up at A2.7, A6.1, A6.4. Read those questions against the definition above so your answers use the term the way the assessor will.
Hypervisor relates to D. Scope; 3. Security Update Management in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.