Servers
Servers, in Cyber Essentials, are devices that provide organisational data or services to other devices as part of your organisation's business. The definition is about function: physical and virtual servers, hypervisor hosts, VDI servers and IaaS instances all count. Servers are listed at A2.7 and fall under all five controls, including malware protection and the 14-day update rule.
- Term
- Servers
- Category
- Devices and software
- Requirement area
- B. Definitions
- Reviewed against
- Requirements v3.3
What does the term servers mean in Cyber Essentials?
Servers, in Cyber Essentials, are devices that provide organisational data or services to other devices as part of your organisation's business.
Servers are devices that provide organisational data or services to other devices as part of your organisation’s business.
How does servers apply to Cyber Essentials?
In plain terms
A server is any machine whose job is to serve something to other machines: the file server in the comms cupboard, the virtual machine running the accounts package, the Azure or AWS instance hosting the website. It does not have to be a big rack-mounted box. A desktop PC under a desk that shares files to the office is doing a server's job.
What does Cyber Essentials ask about servers?
Section B defines the term as quoted above. The definition is about function, not form factor. A physical server, a virtual server, a hypervisor host, a VDI server and an IaaS instance all qualify, and servers appear in the applies-to list of all five controls.
| Question | What it asks about servers |
|---|---|
| A2.7 | Quantities and operating systems. IASME's example: "2 x VMware ESXI 8.0 hosting 8 virtual Windows 2019 servers; 1 x MS Server 2019; 1 x Red Hat Enterprise Linux 8.9" |
| A4.1.1 | Software firewall enabled on servers as well as laptops |
| A5.1 to A5.3 | Unused software and accounts removed, default passwords changed |
| A6.1 and A6.4 | Operating system supported, critical and high-risk fixes within 14 days (A6.4 is an automatic fail on a No) |
| A7.6 and A7.7 | Separate admin accounts, not used for email or browsing |
| A8.1 | Malware protection. The A8.1 guidance says option A (anti-malware software) is for "all in-scope devices running Windows or macOS including servers" |
What an assessor looks for
- Every server listed, including hypervisor hosts and cloud instances, with an operating system version that is still supported.
- A written routine at A6.4.2 where servers are patched by hand rather than automatically. IASME accepts that automatic updates are not always possible "when you have critical systems or servers".
- At Cyber Essentials Plus, internally hosted servers in the sample. Test case 2 scans them, and test cases 3 and 5 include "servers that provide a user-interactive desktop".
Common mistakes
- An old Windows Server kept for one application. Unless it is isolated in a sub-set with no internet access, it fails the support requirement at A6.1.
- Patching the virtual machines but not the hypervisor host underneath them.
- Leaving malware protection off a Windows server because "nobody browses on it".
See the security update management requirements and malware protection. Related: virtual machine, hypervisor, IaaS.
Related terms
- Sub-setA sub-set is part of an organisation whose network is segregated from the rest of the organisation by a firewall or VLAN.
- Virtual machine (VM)A virtual machine is a complete computer, with its own operating system, that runs as software inside another physical computer.
- HypervisorA hypervisor is the software that lets one physical computer run several virtual machines at once, sharing out its processor, memory and storage.
- IaaS (Infrastructure as a Service)Infrastructure as a Service (IaaS) is renting virtual servers and networks from a cloud provider, which your organisation then sets up and looks after much as it would physical equipment.
- SoftwareIn Cyber Essentials, software is any operating system, off-the-shelf application, extension, interpreter, script, library, network software or firewall and router firmware.
- Thin clientA thin client is a simple, low-powered computer that mainly acts as a screen and keyboard for a virtual desktop running somewhere else.
Frequently asked questions
Servers, in Cyber Essentials, are devices that provide organisational data or services to other devices as part of your organisation's business. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, servers comes up at A2.7, A8.1. Read those questions against the definition above so your answers use the term the way the assessor will.
Servers relates to B. Definitions in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.