A2.6: Which laptops, desktops and virtual desktops are in scope?

What does A2.6 ask?

A2.6 asks: “Please list the quantities and operating systems for your laptops, desktops and virtual desktops within the scope of this assessment. Please Note: You must include make and operating system versions for all devices. All user devices declared within the scope of the certification only require the make and operating system to be listed. We have removed the requirement for you to list the model of the device. Only in-scope devices connecting to cloud services must be included in the assessment. Devices outside the declared scope are excluded, but user accounts accessing the cloud service must comply with Cyber Essentials controls, including mandatory MFA. A scope that does not include end user devices is not acceptable.”

A2.6 asks for the quantities and operating systems of your laptops, desktops and virtual desktops in scope. You must include the make and operating system version for every device; IASME has removed the requirement to list the model. A scope that does not include end user devices is not acceptable.

The guidance asks for a summary of every such device that accesses organisational data or services and has internet access, corporate and BYOD alike, and gives the example '25 DELL laptops running Windows 11 Professional version 23H2 and 10 MacBook laptops running MacOS Ventura'. The edition and feature version of Windows are required. Note that the guidance example dates from an earlier version; A6.1 now names macOS Ventura as an example of an unsupported operating system.

The question also says that only in-scope devices connecting to cloud services must be included, and that user accounts accessing cloud services from devices outside the declared scope must still comply with the controls, including mandatory MFA. If any Windows 10 device remains, it needs the Microsoft Extended Security Update programme. Check versions with the is it supported tool and the Windows 11, Windows 10 and macOS pages.

What should you write in the notes field for A2.6?

Write two to four specific sentences for A2.6: what you do, who owns it, how often it happens and the record that proves it.

A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.

Why do applicants fail A2.6?

A common reason applicants fail A2.6: writing 'Windows 11' without the edition and feature version, which the guidance requires.

How do you fix a failing A2.6 answer?

If your answer to A2.6 would not pass today, fix the control first and then write the answer. In order:

1. Export the device list from your MDM or RMM with operating system edition and version (for example Windows 11 Pro 25H2, macOS 26).
2. Add BYOD laptops and desktops that reach email, files or cloud apps.
3. Upgrade or remove any device on an unsupported version; for Windows 10, enrol in Extended Security Updates or upgrade to Windows 11.
4. Group the list as quantity, make and OS version; models are not required.

How do assessors check A2.6?

What evidence should you keep for A2.6?

The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A2.6:

• An MDM or RMM export of devices with operating system edition and version, dated close to submission.
• For any Windows 10 device, proof of Extended Security Update enrolment.