If everything happens inside the hosted desktop, why does my laptop matter?

Because credentials, screen content and often copy/paste flow through the laptop. A compromised endpoint can capture all of that, regardless of where the desktop session is hosted.

Can I scope out personal BYOD that only launches a hosted desktop?

No – it is still accessing organisational data. You can apply lighter controls than MDM, but MFA on the connection and supported OS on the device are non-negotiable.

Do thin clients still need patching?

Yes. Thin client firmware must be supported and updated. Unsupported firmware fails Cyber Essentials in the same way an unsupported OS does.

What about contractors using their own laptops?

Either lend them a managed device, require evidence of their own CE-equivalent controls, or restrict their access so they never reach in-scope systems. Doing none of these is a scope gap.

Hosted Desktops and Cyber Essentials: Are End-User Devices In Scope?

The common misconception

Many teams adopt hosted desktops or VDI specifically to "thin down" the endpoint, then assume the laptop or thin client no longer matters for Cyber Essentials. The scheme's user-device definition does not work that way. If a device is used to access organisational data – including via a hosted desktop session – that device is an in-scope user device.

Device-by-device guide

Thin clients

In scope. They must run a supported OS, receive patches, have host firewalls (where applicable) and be configured securely. See thin clients and zero clients for Cyber Essentials.

Managed company laptops

In scope. Standard CE controls apply – MFA on the connection, patched OS, malware protection, secure config, account separation.

Personal laptops used as BYOD to access hosted desktops

In scope. BYOD does not become out of scope just because the work happens inside a hosted session. See BYOD rules.

Contractor / third-party devices

In scope if they access your hosted desktop using your accounts. You either (a) lend them a managed device, (b) require them to evidence their own CE-equivalent controls, or (c) ringfence their access so they cannot reach in-scope data.

Zero clients

Treated as user devices but with very narrow firmware/config surface. Still need supported firmware and a documented hardening baseline.

The "what the device touches" test

Ask: does this device send or receive organisational data – credentials, screen pixels of in-scope systems, copy-paste content, file uploads? If yes, it is a user device. The hosted-desktop architecture is irrelevant to that test.

What you can legitimately exclude

Personal devices that do not access work systems at all
Devices in a clean room with no network path to the hosted desktop environment
Devices owned by the hosted desktop provider, used only by their engineers – they sit in the provider's scope, not yours

For the provider/customer split, see customer devices vs provider infrastructure.

Practical implications

You still need an asset list of every device that connects to the hosted desktop
BYOD still needs a written policy and MFA on the access account
You cannot rely on the provider's certificate to cover your endpoints
CE Plus testing will sample these endpoints, not just the hosted environment