A2.6.1: Which thin clients are in scope?
Please list the quantity of thin clients within the scope of this assessment. Please include make and operating systems.
Source: IASME Cyber Essentials Danzell question set v16.3
A2.6.1 needs the quantity, make and operating system of every thin client in scope that connects to organisational data or services. Thin clients are simplified computers with a minimal operating system, mainly used to reach virtual desktops. To meet the requirements they must be supported and receive regular security updates, like any other device. If you have none, say so.
Is A2.6.1 an automatic fail?
No. A2.6.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- Please provide a summary of all the thin clients in scope that are connecting to organisational data or services (definitions of which are in the ‘Cyber Essentials Requirements for IT Infrastructure’ document). Thin clients are simplified computers with a minimum operating system, primarily designed for accessing vir…
- Requirement enforced
- Section D of the requirements: the scope must cover the whole IT infrastructure or a well-defined and separately managed sub-set, and cloud services cannot be excluded.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
What does A2.6.1 ask?
A2.6.1 asks: “Please list the quantity of thin clients within the scope of this assessment. Please include make and operating systems.”
A2.6.1 asks for the quantity of thin clients in scope, with make and operating system. The guidance describes thin clients as simplified computers with a minimum operating system, primarily designed for accessing virtual desktops, and warns that some can be modified to work more like traditional PCs, which may introduce security risks.
The guidance is clear that thin clients must be supported and receive regular security updates. That brings their firmware or embedded operating system under A6.1 and A6.4. See thin client.
What should you write in the notes field for A2.6.1?
Write two to four specific sentences for A2.6.1: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
[n] x [IGEL / Dell Wyse / HP] thin clients running [IGEL OS 12 / ThinOS 10 / HP ThinPro version], used to access [Azure Virtual Desktop / Citrix]. Firmware is updated through [management console] within 14 days of critical releases. (Or: none.)
Why do applicants fail A2.6.1?
A common reason applicants fail A2.6.1: old thin clients whose vendor has stopped issuing firmware updates.
- Thin clients that have been repurposed as general PCs but are still listed as thin clients.
- Leaving the field blank instead of writing 'none'.
- Forgetting that the virtual desktops they connect to also need listing in A2.6 and the hosts in A2.7.
How do you fix a failing A2.6.1 answer?
If your answer to A2.6.1 would not pass today, fix the control first and then write the answer. In order:
- List any thin clients with quantity, make and operating system version, or write 'none'.
- Check the vendor still issues firmware or OS updates for each model; replace any that are end of life.
How do assessors check A2.6.1?
What evidence should you keep for A2.6.1?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A2.6.1:
- The thin client management console export with OS or firmware versions.
Where to go next
- Thin clientGlossary
- Virtual desktop infrastructureGlossary
- Scope: what is in and outSection D of v3.3 explained
- Scope checklistBuild the A2 inventory
- All A2 questionsScope of assessment
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A2 questions
- A2.5.1A2.5.1NotesIf you are certifying as partial organisation, please list the equipment used to create any sub-sets.Notes
- A2.6A2.6NotesPlease list the quantities and operating systems for your laptops, desktops and virtual desktops within the scope of this assessment.Notes
- A2.7A2.7NotesPlease list the quantity of servers, virtual servers, virtual server hosts (hypervisors) and Virtual Desktop Infrastructure (VDI) servers. You must include the operating system.Notes
- A2.8A2.8NotesPlease list the quantities of tablets and mobile devices within the scope of this assessment.Notes
Frequently asked questions
A2.6.1 in the 2026 Danzell Cyber Essentials question set asks: "Please list the quantity of thin clients within the scope of this assessment. Please include make and operating systems." It is a notes question, answered in free text.
A2.6.1 needs the quantity, make and operating system of every thin client in scope that connects to organisational data or services. Thin clients are simplified computers with a minimal operating system, mainly used to reach virtual desktops. To meet the requirements they must be supported and receive regular security updates, like any other device. If you have none, say so.
No. A2.6.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Yes, if they connect to organisational data or services. IASME's A2.6.1 guidance says they must be supported and receive regular security updates.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh