Are end-user devices in the VDI provider's scope?

Normally no. The endpoint is the customer's responsibility unless the provider operationally controls it (e.g. supplies and manages thin clients on the customer's behalf).

Are hypervisors in scope for Cyber Essentials?

Yes – if the VDI workloads run on hypervisors operated by the certified organisation, those hypervisors and their management plane are in scope.

Who is responsible for the user session itself?

Operationally the provider runs the session host, but the customer is responsible for what their users do inside the session, their data, and the device they connect from.

Can we just exclude VDI from our Cyber Essentials scope?

Only if VDI plays no part in handling organisational data. If staff use VDI to access work systems, the customer must reflect the endpoint and identity in their own scope, and rely on the provider's certificate for the infrastructure side.

VDI and Cyber Essentials: What Is Actually In Scope?

VDI splits scope between two organisations

VDI almost always involves at least two parties: the provider who runs the platform, and the customer whose users log in from their own devices. Cyber Essentials scope follows ownership and operational control, so the same VDI deployment produces two separate scope statements – one for each party.

What is in scope for the provider

VDI infrastructure – connection broker, gateway, image management, profile services
Hypervisors hosting the VDI workloads, plus their management plane
Server operating systems running the session hosts and management roles
Hosted network – internal segmentation, tenant isolation, ingress filtering
Administrator endpoints – the laptops/jump boxes used to manage all of the above
Privileged accounts used by provider engineers

What is normally out of scope for the provider

Customer-owned end-user devices (laptops, thin clients, BYOD)
Customer identity providers (unless the provider operates them)
Customer-owned admin accounts or self-service consoles
Customer data residing inside the VDI sessions

Customers should not assume the provider has them covered. Their own CE submission must still describe how they manage the device they use to launch the VDI session – see hosted desktops and end-user devices.

When end-user devices ARE in the provider's scope

If the provider also owns or manages the endpoint (e.g. supplies a managed thin client, or runs MDM on the customer's behalf), that device joins the provider's scope. The test is operational control: who patches it, who configures it, who controls the admin account on it.

The CE controls applied to VDI infrastructure

Firewalls – hosted network boundary plus host firewalls on management servers
Secure configuration – hardened gold images for both server OS and VDI desktops, no default credentials
Access control – MFA on all admin accounts, separation between admin and standard accounts, leavers process for engineers
Malware protection – on session hosts and management servers
Patch management – 14 days for high/critical CVEs across hypervisors, server OS and VDI agent software

Where providers commonly get scope wrong

Excluding hypervisors because "they're underneath the VDI" – they are not; they are in scope
Forgetting the management plane (vCenter, AVD control plane, Citrix Cloud admin portal)
Implying customer endpoints are covered, when they are not
Leaving the build pipeline for gold images out of scope when it touches production

For the wording side of this problem, read bad vs good scope statements.