In short: Cyber Essentials BYOD rules put any user-owned device that accesses organisational data or services in scope, unless it is used only for native calls, native texts or an MFA app. Home-working devices are in scope too. A router you supply is in scope; other home routers are not, so those devices need a software firewall.
When a personal device is in scope
Requirements v3.3 brings user-owned devices into scope as soon as they access organisational data or organisational services. Data means any electronic information belonging to the organisation: email, documents, databases, financial records. Services cover the software and cloud platforms you own or subscribe to, such as Microsoft 365, Google Workspace, web applications, virtual desktops, mobile device management containers and IP telephony.
There is one narrow exception. A mobile or remote device used only for native voice calls, native text messages or a multi-factor authentication app is out of scope.
| Example | In or out of scope? |
|---|---|
| Personal phone used only to make calls, send texts and approve MFA prompts | Out of scope |
| Personal phone with Outlook, Teams or Gmail for work | In scope |
| Personal tablet used to read work documents in a browser | In scope |
| Home PC used occasionally to check webmail | In scope |
| Personal laptop that never connects to any work system | Out of scope |
The question is what the device can reach, not who paid for it. That is why most small organisations find BYOD is the biggest single scope issue they face.
Whose devices count
Version 3.3 sets out how roles affect BYOD. Employees, volunteers, trustees and university research assistants using their own devices are in scope. Students' own devices are out of scope, as are devices owned by MSP administrators, contractors and customers. Anything your organisation owns is in scope whoever uses it, including equipment lent to third parties.
If a device is out of scope, you are still expected to make sure it is configured properly before it touches your data. You decide how, outside the assessment. For volunteer-heavy organisations, see Cyber Essentials for charities.
Home and remote working
The NCSC's default position is that every corporate or user-owned device used for your business at home or on the move is in scope. The home network itself is handled like this:
- A router you supply to the home worker is in scope and must meet the firewall requirements, including a changed default admin password.
- Any other home router, such as the one the broadband provider sent, is out of scope. Because you do not control it, the firewall control has to be applied on the device itself, normally with the operating system's built-in software firewall.
- With a corporate VPN, the home worker's internet boundary sits at your company firewall or your virtual or cloud firewall. The VPN must be administered by you so the firewall controls can be applied there.
- Wireless access points inside an internet provider's home router are out of scope.
The same software-firewall logic applies on hotel, café and train Wi-Fi: if you do not control the network, the device protects itself.
Applying the five controls to personal devices
A device in scope must meet every control, whoever owns it. In practice:
| Control | What it means on a BYOD phone, tablet or laptop |
|---|---|
| Firewalls | Software firewall switched on for laptops and desktops used away from a managed network |
| Secure Configuration | Device locks with biometrics, a password or a PIN of at least six characters; protection against repeated guessing; unneeded apps and accounts removed |
| Security Update Management | Operating system still supported by its vendor and critical or high-risk updates installed within 14 days. Under Danzell, late updates are an automatic fail |
| User Access Control | Unique work accounts, MFA on every cloud service, no day-to-day use of admin rights for work |
| Malware Protection | Anti-malware on Windows and macOS, or application allow listing restricted by code signing on any device |
The update rule is the one that catches people out. An old phone that no longer receives operating system updates fails, however careful its owner is.
Practical options for BYOD
There is no single right answer, but most organisations use one or more of these:
- Enrol devices in mobile device management. Tools such as Microsoft Intune can enforce screen locks, minimum operating system versions and encryption, and report the evidence you need for the question set.
- Protect the apps rather than the whole device. App protection policies and work containers can require a PIN, block copy and paste into personal apps and wipe work data remotely. The device is still in scope if it reaches your data, so it must still meet the update and lock requirements.
- Block devices that do not comply. Conditional access rules can stop unmanaged, out-of-date or jailbroken devices reaching email and files at all. A device that cannot access organisational data or services is no longer in scope.
- Issue work devices to the people who need full access, and limit personal devices to calls, texts and an authenticator app.
- Use a virtual desktop for occasional access, remembering that the device connecting to it is still in scope.
Device management and mobile threat defence products such as Sophos Mobile and Check Point Harmony Mobile add device health checks and protection against malicious apps and links, and Cisco Duo device trust can check a device's health at login.
How we help
We survey which personal and home devices actually reach your systems (sign-in logs usually tell the story), agree a BYOD policy that staff will accept, and set up device management, app protection or conditional access to enforce it. We then help you describe the arrangement accurately in the question set and check it against the Cyber Essentials checklist before you submit. To sort out BYOD before your assessment, contact us.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is my personal phone in scope for Cyber Essentials?
It is in scope if it accesses organisational data or services, for example work email, Teams, shared files or a business app. It is out of scope if you use it only for native phone calls, text messages and an MFA authenticator app.
Do home routers have to meet Cyber Essentials?
Only if your organisation supplied the router. Routers belonging to the home worker or their internet provider are out of scope, which means the firewall control must be met on the device itself, usually with the built-in software firewall.
Does a VPN take home devices out of scope?
No. The devices remain in scope. A corporate VPN that you administer moves the home worker's internet boundary to your company firewall or cloud firewall, so the firewall controls are applied there rather than relying on the home router.
Are volunteers' and trustees' own devices in scope?
Yes. Requirements v3.3 lists volunteer and trustee BYOD as in scope when the devices access organisational data or services. Students' own devices are out of scope, as are devices owned by contractors, MSP staff and customers.
Can an old phone that no longer gets updates be used for work email?
Not within a Cyber Essentials scope. Software must be supported by its vendor and critical or high-risk updates installed within 14 days. Either replace the phone, or stop it accessing organisational data so it falls out of scope.