Personal devices (BYOD) and Cyber Essentials

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

When is a personal device in scope?

Bring Your Own Device (BYOD) is one of the biggest surprises for small businesses applying for Cyber Essentials. Under Section D(i) of the NCSC Requirements for IT Infrastructure v3.3 (page 8), any user-owned device belonging to an employee, volunteer, trustee or research assistant that accesses organisational data (such as emails, documents or financial records) or organisational services (such as Microsoft 365, Google Workspace or a cloud CRM) is in scope.

Version 3.3 lists just three things a personal phone can do while staying out of scope:

• Native voice applications (normal telephone calls).
• Native text applications (normal SMS text messages).
• Multi-Factor Authentication (MFA) applications (such as Microsoft Authenticator, Google Authenticator or Duo).

As soon as a staff member adds their work Outlook, Apple Mail, Gmail, Teams or OneDrive account to their personal iPhone or Android phone, that phone is in scope.

What rules apply to in-scope personal devices?

Every in-scope personal device must meet the same technical requirements as a company-owned device:

1. Supported operating system: The phone, tablet or home computer must run an iOS, Android, Windows or macOS version that still receives regular security updates from Apple, Google or Microsoft.
2. 14-day critical updates: Operating system and app security fixes must be installed within 14 days of release (an automatic-fail requirement under Danzell).
3. Screen lock and brute-force protection: A biometric (Face ID, Touch ID, fingerprint) or a minimum 6-character PIN/passcode, locking or throttling after no more than 10 failed attempts.
4. Malware protection / app allow-listing: Phones and tablets must not be jailbroken or rooted and must only install apps from official stores; personal Windows or Mac computers must run active anti-malware and a software firewall.

The common catch: older personal phones

In almost every firm of 15 to 50 staff, at least one person checks work email on a five-year-old personal iPhone or budget Android handset whose manufacturer stopped issuing security updates last year. If that phone is in scope on the day your certificate is issued, it breaches the supported-software requirement.

Three practical ways to handle BYOD

1. Option 1: Block personal computers, and manage work apps on supported personal phones (most popular). Use Microsoft Intune App Protection Policies (Mobile Application Management without full device enrolment) and Conditional Access to allow Outlook and Teams only on personal phones running a supported iOS or Android version with a 6+ digit PIN, while blocking personal home PCs from downloading company files.
2. Option 2: Keep personal devices out of scope by restricting access. Ask staff to remove work email and Teams from personal phones (leaving only Microsoft Authenticator for MFA prompts, which is out of scope) and block mobile sign-ins from un-enrolled devices in Conditional Access.
3. Option 3: Supply company phones to staff who need mobile email. Enrol company-owned iPhones or Androids in Intune so you control updates and settings directly.

Whichever approach you pick, put it in writing using the BYOD policy template in our free Evidence pack generator.