Virtual desktop infrastructure (VDI)
Virtual desktop infrastructure is a way of running staff desktops on central servers or in the cloud, so the user's own device only displays the desktop. For Cyber Essentials the virtual desktops are listed at A2.6, the VDI servers at A2.7 and any thin clients at A2.6.1. The devices people use to connect are in scope too.
- Term
- Virtual desktop infrastructure
- Also known as
- VDI, Virtual desktop, Hosted desktop
- Category
- Devices and software
- Requirement area
- B. Definitions; D. Scope
- Reviewed against
- Requirements v3.3
What does the term virtual desktop infrastructure mean in Cyber Essentials?
Virtual desktop infrastructure is a way of running staff desktops on central servers or in the cloud, so the user's own device only displays the desktop.
How does virtual desktop infrastructure apply to Cyber Essentials?
In plain terms
It is like streaming a film instead of owning the DVD. The film lives on someone else's computer, and your screen just plays it. With VDI, each person's Windows desktop, applications and files live on a server or in the cloud, and they reach it from a laptop, a home PC or a thin client. Citrix, Azure Virtual Desktop and Windows 365 are common examples.
What Cyber Essentials asks
The NCSC definition of an organisational service includes "user interactive desktops" and names Citrix Desktop and virtual desktop services among its examples. Any device that reaches an organisational service is in scope, including a personal one.
The question set asks for each layer separately. A2.6 covers laptops, desktops and virtual desktops. A2.6.1 covers thin clients. A2.7 asks for "Virtual Desktop Infrastructure (VDI) servers" with their operating systems. The virtual desktops themselves need secure configuration, malware protection and updates in the same way as a physical PC.
Common mistakes
- Treating the virtual desktop as the only in-scope device and leaving out the laptops or home PCs used to reach it.
- Patching the desktop image but not the servers behind it.
- Forgetting that a cloud-hosted desktop service is a cloud service, and cloud services cannot be excluded from scope.
See the BYOD scope rules and cloud services scope. Related: thin client, virtual machine, organisational service.
Related terms
- Thin clientA thin client is a simple, low-powered computer that mainly acts as a screen and keyboard for a virtual desktop running somewhere else.
- Virtual machine (VM)A virtual machine is a complete computer, with its own operating system, that runs as software inside another physical computer.
- Organisational serviceAn organisational service is any software application, cloud application, cloud service, user interactive desktop or mobile device management system your organisation owns or subscribes to.
- Vulnerability fixesVulnerability fixes are patches, updates, registry fixes, configuration changes, scripts or any other mechanism approved by the vendor to fix a known vulnerability.
- Zero-day vulnerabilityA zero-day is a security flaw that attackers know about and can use before the software maker has released a fix, so defenders have had zero days to patch it.
- Auto-run (AutoRun and AutoPlay)Auto-run is a feature that opens or runs a file automatically, without asking, for example when a USB stick is plugged in or a download finishes.
Frequently asked questions
Virtual desktop infrastructure is a way of running staff desktops on central servers or in the cloud, so the user's own device only displays the desktop.
In the 2026 Danzell question set, virtual desktop infrastructure comes up at A2.6, A2.6.1, A2.7. Read those questions against the definition above so your answers use the term the way the assessor will.
Virtual desktop infrastructure relates to B. Definitions; D. Scope in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.