Cyber Essentials for Mobile Phones and BYOD

Last checked: 2 November 2026

Yes, mobile phones are in scope for Cyber Essentials, including staff-owned phones (BYOD) that access your organisation's data or services such as email, Microsoft 365 or your phone system app. Under the current requirements (v3.3, effective 27 April 2026), each in-scope phone must run supported software, get high and critical security updates within 14 days, be locked with a PIN of at least 6 characters or a biometric, and only run approved, signed apps. Phones used only for ordinary calls, texts or an MFA app are out of scope.

This guide covers what the NCSC's Requirements for IT Infrastructure v3.3 says about phones and tablets, and what that means when you choose, renew or replace business mobiles.

Are mobile phones in scope for Cyber Essentials?

Yes. The requirements define devices as including "end user devices such as desktop computers, laptops, thin clients, tablets and smartphones - whether physical or virtual". Four of the five technical controls (secure configuration, security update management, user access control and malware protection) list "tablets, mobile phones" under "Applies to".

The firewall control is the exception. Its "Applies to" list covers boundary firewalls, desktops, laptops, routers, servers and cloud services, but not mobile phones.

Is BYOD in scope for Cyber Essentials?

Yes, if the personal phone touches work. The v3.3 document says: "In addition to mobile or remote devices owned by the organisation, user-owned devices which access organisational data or services (as defined above) are in scope."

The definitions matter. Organisational data "includes any electronic data belonging to your organisation, for example, emails, documents, database data, financial data". An organisational service includes "software applications, cloud applications, cloud services, user interactive desktops and mobile device management (MDM) solutions", with examples including Microsoft 365, Google Workspace, MDM containers and "IP telephony".

So an employee's own phone with Outlook, Teams or a VoIP softphone app on it is in scope.

Which phones are out of scope?

The requirements say "all mobile or remote devices used only for the purpose of" these are out of scope:

• native voice applications
• native text applications
• multi-factor authentication (MFA) applications

A personal phone that only takes calls and texts from colleagues, or only runs an authenticator app, does not need to meet the controls. Add one work app, such as email, and it comes back into scope.

Whose personal devices count?

Table 2 in the requirements puts BYOD devices of employees, volunteers and trustees in scope. BYOD devices belonging to third-party contractors, MSP administrators and customers are out of scope. The NCSC adds that for out-of-scope devices, "your organisation is still responsible for confirming that the devices interacting with organisational services and data are configured correctly".

What does Cyber Essentials require on each phone?

What counts as a critical or high-risk update?

The requirements define them as vulnerabilities "with a CVSS v3 base score of 7 or above, or are identified by the vendor as 'critical or high risk'". If an update fixes issues of mixed severity and any of them is critical or high risk, the whole update must be installed within 14 days. Where the vendor gives no severity details, the 14-day rule also applies. The NCSC recommends, but does not require, applying every update within 14 days.

What about phones that no longer get updates?

Unsupported software must be removed from devices, or "removed from scope by using a defined sub-set that prevents all traffic to or from the internet". A smartphone with no internet access is not much use, so in practice an unsupported phone that accesses work data has to be replaced or taken off work services. The requirements also say the vendor "must provide the future date when they will stop providing" fixes, which is why manufacturers' update-period commitments matter when you buy. Our guides to when Android phones stop getting updates and iPhones losing support cover how to check this for your fleet.

Do phones need antivirus for Cyber Essentials?

Not under v3.3. The anti-malware software option is described as being for devices "running Windows or MacOS". For phones and tablets, the option that applies is application allow listing: approved, code-signed apps only, which is how the official iOS and Android app stores work when sideloading is blocked.

Do phones need a firewall?

Mobile phones are not in the firewall control's "Applies to" list. The requirements do say to "use a software firewall on devices which are used on untrusted networks, such as public wifi hotspots", which matters for laptops your staff tether to a phone hotspot. If you give home workers a router, that router is in scope; other home routers are out of scope.

How do you manage BYOD for Cyber Essentials?

The NCSC acknowledges that "BYOD complicates matters, as users are given more freedom to 'customise' their experience". You have three practical routes:

1. Restrict work apps to company phones. Personal phones are then only used for calls, texts and MFA apps, which keeps them out of scope.
2. Enforce the controls on personal phones. Use MDM or app protection to check PIN length, OS version and app sources before granting access. Our MDM for small business guide explains the difference between full device management and app protection.
3. Mix both. Company phones for staff who need email and line-of-business apps, with personal phones limited to MFA.

Whichever you choose, write it into your mobile policy so staff know which apps may go on which phones.

Worked example: a 12-person office applying for Cyber Essentials

Picture a firm with eight company iPhones and Androids, four staff who read Outlook on their own phones, and two field engineers who only use their personal phones for calls and an authenticator app.

1. Scope: 12 phones are in scope: the eight company phones and the four personal phones with Outlook. The two engineers' phones are out of scope because they only use native voice and MFA apps.
2. Support check: one company Android no longer gets security updates. It must be replaced or taken off work services before assessment.
3. Settings: set a 6-character minimum PIN, automatic updates and brute-force lockout across all 12, using MDM where possible.
4. Apps: block sideloading and keep an approved app list.
5. Accounts: confirm MFA is enforced on Microsoft 365 for every user.

The result is a short list of devices to replace, policies to set, and personal phones to either enrol or remove from work apps.

How much does Cyber Essentials cost?

The NCSC overview says Cyber Essentials is "priced according to the size of your organisation, starting at £320 +VAT". Cyber Essentials Plus adds "more rigorous, independent technical testing" and is quoted individually. The same page says UK organisations with turnover under £20m that certify their whole organisation are "automatically entitled to Cyber Liability Insurance" arranged by IASME, the Cyber Essentials delivery partner.

Cyber Essentials is not a legal requirement for most businesses. The NCSC calls it "the minimum standard of cyber security recommended by the Government" and notes that "a growing number of organisations require suppliers to be certified to bid for work".

Frequently asked questions

Does a phone used only for MFA count for Cyber Essentials?

No. Mobile devices used only for MFA applications, native voice or native text applications are out of scope under v3.3. Once the phone accesses email, files or other work services, it is in scope.

What PIN length does Cyber Essentials require on mobile phones?

If the credential is only used to unlock the device, the minimum password or PIN length is 6 characters. Biometrics such as fingerprint or face unlock are also accepted. The device must lock after no more than 10 failed attempts, or throttle guesses, or use the vendor default where these cannot be configured.

Can old phones pass Cyber Essentials?

Only while the manufacturer still supports them with security updates. Unsupported software must be removed or placed in a sub-set with no internet access, so an out-of-support phone that accesses work data will fail.

Is BYOD allowed under Cyber Essentials?

Yes. BYOD is allowed, but personal phones that access organisational data or services are in scope and must meet the same controls as company phones.

Which version of Cyber Essentials applies in 2026?

The NCSC resources page lists Requirements for IT Infrastructure v3.3 as the current version, effective from 27 April 2026.

Related guides

• MDM for small business: iPhone, Android and BYOD
• When do business Android phones stop getting updates?
• iPhones losing support: business fleet guide
• Business mobile cyber security
• Business mobile encryption guide
• GDPR when an employee leaves

Sources

• NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3
• NCSC: Cyber Essentials resources
• NCSC: Cyber Essentials overview