What Cyber Essentials checks
Cyber Essentials is the UK government-backed scheme run by IASME on behalf of the NCSC. It checks five technical controls: firewalls, secure configuration, user access control, malware protection and security update management. Many public sector contracts and a growing number of private clients and insurers ask for it.
Cloud services are in scope
Since the 2022 update, cloud services you use are in scope, along with the devices staff use to reach them. Moving to a hosted desktop does not remove the question. It changes who handles each part of the answer.
What a hosted desktop takes off your plate
On a managed hosted desktop, the servers, their firewalls, patching, antivirus and backups are run by the provider in a UK data centre. Applications such as Sage or case management are updated centrally rather than on every PC. Company data stays in the hosted environment instead of on laptops, so a lost device is a smaller problem.
What still sits with you
- The devices staff log in from: laptops and PCs in scope still need supported operating systems, updates and malware protection.
- Accounts: leavers removed promptly, admin rights kept to the few who need them, and multi-factor authentication switched on.
- Home and office routers: default passwords changed and firmware kept up to date.
Ask your provider for this
Ask how the platform is patched and how quickly, whether multi-factor sign-in is enforced, where the data is held, how backups are tested and whether they will answer the cloud-service questions on your Cyber Essentials self-assessment. A good provider will give you written answers.
A short rule
A hosted desktop makes the server side of Cyber Essentials much simpler. The devices and accounts your staff use are still yours to keep in order, so plan for both.