BYOD (bring your own device)
BYOD, short for bring your own device, means staff using their own personal phones, tablets or computers to do work. Under Cyber Essentials, a personal device that accesses organisational data or services is in scope, unless it is used only for calls, texts or MFA apps. BYOD devices are listed alongside company devices at A2.6 and A2.8.
- Term
- BYOD
- Also known as
- Bring your own device, Personal devices, User-owned devices
- Category
- Devices and software
- Requirement area
- D(i) BYOD
- Reviewed against
- Requirements v3.3
What does the term BYOD mean in Cyber Essentials?
BYOD, short for bring your own device, means staff using their own personal phones, tablets or computers to do work.
In addition to mobile or remote devices owned by the organisation, user-owned devices which access organisational data or services (as defined above) are in scope.
How does BYOD apply to Cyber Essentials?
In plain terms
A member of staff reading work email on their own iPhone is BYOD. So is a bookkeeper logging into the accounts system from their home laptop in the evening. The device belongs to the person, but the data on it belongs to the business.
What Cyber Essentials asks
The rule is quoted above. The NCSC then lists three exceptions: devices used only for "native voice applications", "native text applications" and "multi-factor authentication (MFA) applications" are out of scope. A phone that only makes calls, sends texts and shows MFA codes is not counted. The same phone with Outlook or Teams signed in is.
The A2.6 guidance says the device list "applies to both your corporate and user owned devices (BYOD)". A8.5 asks you to keep a list of approved applications and says "This includes employee-owned devices", adding that MDM is not required if you meet the requirement through policy, processes and staff training.
Common mistakes
- Leaving personal phones with work email or chat apps off the A2.8 list.
- Assuming a written policy takes personal devices out of scope. If a device reaches organisational data or services, it is in scope.
- Allowing old personal phones whose operating system is no longer supported by the maker.
See the BYOD scope rules and the iOS and iPadOS and Android setup guides. Related: mobile device management, organisational data, end-user device.
Related terms
- Mobile device management (MDM)Mobile device management is software that lets an organisation set up, secure and track its phones, tablets and laptops remotely from one console.
- Organisational dataOrganisational data is any electronic data belonging to your organisation, for example emails, documents, database data and financial data.
- End-user device (EUD)An end-user device is any computer, tablet, phone or thin client that a person uses directly to do their work.
- CVE (Common Vulnerabilities and Exposures)A CVE is a unique public reference number given to a known security flaw, so vendors, scanners and IT teams can all refer to the same problem.
- CVSS (Common Vulnerability Scoring System)CVSS, the Common Vulnerability Scoring System, is the 0 to 10 scale Cyber Essentials uses to define critical and high-risk vulnerabilities.
- Device unlockingDevice unlocking is the check, such as a PIN, password, fingerprint or face scan, that a person must pass before they can use a laptop, phone or tablet.
Frequently asked questions
BYOD, short for bring your own device, means staff using their own personal phones, tablets or computers to do work. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, BYOD comes up at A2.6, A2.8, A8.5. Read those questions against the definition above so your answers use the term the way the assessor will.
BYOD relates to D(i) BYOD in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.