Thin client
A thin client is a simple, low-powered computer that mainly acts as a screen and keyboard for a virtual desktop running somewhere else. Cyber Essentials treats thin clients as end-user devices: they are listed at A2.6.1, named in secure configuration questions A5.1 and A5.3, and must be supported and receive regular security updates.
- Term
- Thin client
- Category
- Devices and software
- Requirement area
- B. Definitions; 2. Secure Configuration
- Reviewed against
- Requirements v3.3
What does the term thin client mean in Cyber Essentials?
A thin client is a simple, low-powered computer that mainly acts as a screen and keyboard for a virtual desktop running somewhere else.
How does thin client apply to Cyber Essentials?
In plain terms
A thin client works like a TV box. The programme is made and stored somewhere else, and the box just shows it on your screen. With a thin client, the desktop, the files and the applications all run on a server or in the cloud, and the small box on the desk displays them. You often see them in call centres, surgeries and schools.
What Cyber Essentials asks
The NCSC lists thin clients in its definition of devices and in the devices the secure configuration control applies to. The IASME guidance at A2.6.1 describes them directly: "Thin clients are simplified computers with a minimum operating system, primarily designed for accessing virtual desktops. While thin clients can connect to the internet, some can be modified to function more like traditional PCs, which may introduce security risks. To meet Cyber Essentials requirements, thin clients must be supported and receive regular security updates."
A2.6.1 asks for the quantity, make and operating system of your thin clients. A5.1 asks whether unused software has been removed from them, and A5.3 whether their default passwords have been changed.
Common mistakes
- Treating a thin client as "just a terminal" and leaving it off the scope.
- Forgetting the thin client's own operating system or firmware when the maker stops supporting it.
- Listing the thin clients but not the servers behind them. VDI servers belong at A2.7.
See the scope overview and question A2.6.1. Related: virtual desktop infrastructure, end-user device, devices.
Related terms
- Virtual desktop infrastructure (VDI)Virtual desktop infrastructure is a way of running staff desktops on central servers or in the cloud, so the user's own device only displays the desktop.
- End-user device (EUD)An end-user device is any computer, tablet, phone or thin client that a person uses directly to do their work.
- DevicesDevices, in Cyber Essentials, are all types of hosts, networking equipment, servers, networks and end user devices such as laptops, tablets and smartphones, whether physical or virtual.
- Unnecessary softwareUnnecessary software is any program, built-in tool or background service on a device or cloud account that the business does not use.
- VendorA vendor is the company or organisation that supplies a piece of software or hardware and is responsible for fixing its security flaws.
- Virtual machine (VM)A virtual machine is a complete computer, with its own operating system, that runs as software inside another physical computer.
Frequently asked questions
A thin client is a simple, low-powered computer that mainly acts as a screen and keyboard for a virtual desktop running somewhere else.
In the 2026 Danzell question set, thin client comes up at A2.6.1, A5.1, A5.3. Read those questions against the definition above so your answers use the term the way the assessor will.
Thin client relates to B. Definitions; 2. Secure Configuration in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.