Virtual machine (VM)
A virtual machine is a complete computer, with its own operating system, that runs as software inside another physical computer. Cyber Essentials treats it like a physical device, because the NCSC definition of devices covers equipment 'whether physical or virtual'. Virtual servers are listed at A2.7 and virtual desktops at A2.6.
- Term
- Virtual machine
- Also known as
- VM, Virtual server
- Category
- Devices and software
- Requirement area
- B. Definitions; D. Scope
- Reviewed against
- Requirements v3.3
What does the term virtual machine mean in Cyber Essentials?
A virtual machine is a complete computer, with its own operating system, that runs as software inside another physical computer.
How does virtual machine apply to Cyber Essentials?
In plain terms
Picture a large house converted into flats. There is one building, but each flat has its own front door, its own keys and its own tenant. A physical server running virtual machines is the building, and each virtual machine is a flat. If one flat's door is left open, a burglar gets into that flat, so each one needs its own locks.
What Cyber Essentials asks
The NCSC definition of devices ends with the words "whether physical or virtual", so every control applies to a virtual machine in the same way as to a physical one. A2.7 asks you to list "servers, virtual servers, virtual server hosts (hypervisors) and Virtual Desktop Infrastructure (VDI) servers" with their operating systems. IASME's example is "2 x VMware ESXI 8.0 hosting 8 virtual Windows 2019 servers". A2.6 covers virtual desktops.
Virtual machines rented from a cloud provider are IaaS. The NCSC describes IaaS as virtual servers and network equipment "that, much like physical equipment, your organisation configures and manages". For Cyber Essentials Plus, test cases 2 and 3 are run on sampled IaaS instances as well as on end-user devices and servers.
Common mistakes
- Listing the host but not the virtual machines on it, or the other way round.
- Leaving an old virtual machine from a past project running. If it can reach the internet it is in scope, and an unsupported operating system on it fails the A6.1 requirement.
See the scope overview and the Azure and AWS setup guides. Related: hypervisor, servers, virtual desktop infrastructure.
Related terms
- HypervisorA hypervisor is the software that lets one physical computer run several virtual machines at once, sharing out its processor, memory and storage.
- ServersServers, in Cyber Essentials, are devices that provide organisational data or services to other devices as part of your organisation's business.
- Virtual desktop infrastructure (VDI)Virtual desktop infrastructure is a way of running staff desktops on central servers or in the cloud, so the user's own device only displays the desktop.
- Vulnerability fixesVulnerability fixes are patches, updates, registry fixes, configuration changes, scripts or any other mechanism approved by the vendor to fix a known vulnerability.
- Zero-day vulnerabilityA zero-day is a security flaw that attackers know about and can use before the software maker has released a fix, so defenders have had zero days to patch it.
- Auto-run (AutoRun and AutoPlay)Auto-run is a feature that opens or runs a file automatically, without asking, for example when a USB stick is plugged in or a download finishes.
Frequently asked questions
A virtual machine is a complete computer, with its own operating system, that runs as software inside another physical computer.
In the 2026 Danzell question set, virtual machine comes up at A2.6, A2.7. Read those questions against the definition above so your answers use the term the way the assessor will.
Virtual machine relates to B. Definitions; D. Scope in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.