A2.7: Which servers, hypervisors and VDI servers are in scope?
Please list the quantity of servers, virtual servers, virtual server hosts (hypervisors) and Virtual Desktop Infrastructure (VDI) servers. You must include the operating system.
Source: IASME Cyber Essentials Danzell question set v16.3
A2.7 needs the quantity and operating system of every server in scope: physical servers, virtual servers, the hypervisors that host them and VDI servers, including IaaS servers in the cloud. IASME's example is '2 x VMware ESXi 8.0 hosting 8 virtual Windows 2019 servers; 1 x MS Server 2019; 1 x Red Hat Enterprise Linux 8.9'.
Is A2.7 an automatic fail?
No. A2.7 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- Please list the quantity of all servers within the scope of this assessment.
- Requirement enforced
- Section D of the requirements: the scope must cover the whole IT infrastructure or a well-defined and separately managed sub-set, and cloud services cannot be excluded.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
What does A2.7 ask?
A2.7 asks: “Please list the quantity of servers, virtual servers, virtual server hosts (hypervisors) and Virtual Desktop Infrastructure (VDI) servers. You must include the operating system.”
A2.7 asks for the quantity of servers, virtual servers, virtual server hosts (hypervisors) and Virtual Desktop Infrastructure (VDI) servers, including the operating system. The guidance asks for all servers within the scope and gives the example: 2 x VMware ESXi 8.0 hosting 8 virtual Windows 2019 servers; 1 x MS Server 2019; 1 x Red Hat Enterprise Linux 8.9.
v3.3 defines servers as devices that provide organisational data or services to other devices. A hypervisor is software on an in-scope device, so its version must be supported too. IaaS virtual machines you manage are your responsibility for patching and malware protection. See Windows Server support dates, hypervisor and cloud services in scope.
What should you write in the notes field for A2.7?
Write two to four specific sentences for A2.7: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
On premises: [1] x [Dell PowerEdge] running [VMware ESXi 8.0 U3 / Hyper-V Server on Windows Server 2022], hosting [n] x Windows Server 2022 Standard virtual servers ([roles: domain controller, file server]). Cloud IaaS: [n] x Azure virtual machines running [Windows Server 2022 Datacenter / Ubuntu 24.04 LTS]. VDI: [n] x [session hosts and OS]. (Or: no servers; all services are SaaS.)
Why do applicants fail A2.7?
A common reason applicants fail A2.7: listing the guest servers but not the hypervisor host version.
- A Windows Server 2012 R2 or older server still running a line-of-business application.
- Forgetting IaaS virtual machines in Azure or AWS.
- Including SaaS services here; they belong in A2.9.
How do you fix a failing A2.7 answer?
If your answer to A2.7 would not pass today, fix the control first and then write the answer. In order:
- List physical servers, hypervisor hosts and their versions, guest virtual servers, VDI hosts and IaaS virtual machines with operating systems.
- Upgrade or retire any server past its end of support, such as Windows Server 2012 R2.
- Move SaaS services you listed here to A2.9.
How do assessors check A2.7?
What evidence should you keep for A2.7?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A2.7:
- A server inventory with operating system and hypervisor versions, including IaaS virtual machines.
Where to go next
- Windows Server support datesWhich versions pass
- Windows Server 2012 R2Support dates
- HypervisorGlossary
- Azure setupSetup guide
- Scope: what is in and outSection D of v3.3 explained
- All A2 questionsScope of assessment
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A2 questions
- A2.6A2.6NotesPlease list the quantities and operating systems for your laptops, desktops and virtual desktops within the scope of this assessment.Notes
- A2.6.1A2.6.1NotesPlease list the quantity of thin clients within the scope of this assessment. Please include make and operating systems.Notes
- A2.8A2.8NotesPlease list the quantities of tablets and mobile devices within the scope of this assessment.Notes
- A2.9A2.9NotesPlease list all the cloud services that are in use by your organisation and provided by a third party.Notes
Frequently asked questions
A2.7 in the 2026 Danzell Cyber Essentials question set asks: "Please list the quantity of servers, virtual servers, virtual server hosts (hypervisors) and Virtual Desktop Infrastructure (VDI) servers. You must include the operating system." It is a notes question, answered in free text.
A2.7 needs the quantity and operating system of every server in scope: physical servers, virtual servers, the hypervisors that host them and VDI servers, including IaaS servers in the cloud. IASME's example is '2 x VMware ESXi 8.0 hosting 8 virtual Windows 2019 servers; 1 x MS Server 2019; 1 x Red Hat Enterprise Linux 8.9'.
No. A2.7 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Yes. A2.7 asks for virtual server hosts (hypervisors) as well as the virtual servers. The hypervisor's version must be supported and patched.
Not any more. Standard support ended on 10 October 2023 and Microsoft's paid Extended Security Updates for 2012 R2 ended on 13 October 2026. An in-scope 2012 R2 server must now be upgraded, removed or moved into a sub-set with no internet access.
IaaS virtual machines you manage go in A2.7 with their operating system. The cloud platform itself (Azure, AWS) is listed as an IaaS service in A2.9.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh