Device unlocking
Device unlocking is the check, such as a PIN, password, fingerprint or face scan, that a person must pass before they can use a laptop, phone or tablet. Cyber Essentials requires one on every device used in person, protected against guessing, with a PIN or password of at least 6 characters. A5.9 and A5.10 ask about it.
- Term
- Device unlocking
- Also known as
- Screen lock, Device lock, Lock screen
- Category
- Devices and software
- Requirement area
- 2. Secure Configuration
- Reviewed against
- Requirements v3.3
What does the term device unlocking mean in Cyber Essentials?
Device unlocking is the check, such as a PIN, password, fingerprint or face scan, that a person must pass before they can use a laptop, phone or tablet.
If a device requires a user’s physical presence to access a device’s services (such as logging on to a laptop or unlocking a mobile phone), a credential such as a biometric, password or PIN must be in place before a user can gain access to the services.
How does device unlocking apply to Cyber Essentials?
In plain terms
The unlock screen is the front door lock of a device. If a phone is left in a taxi or a laptop is stolen from a car, that lock is the only thing between the finder and your email, files and customer records.
What Cyber Essentials asks
The rule is quoted above. The chosen method must also be protected against guessing. Where it can be configured, the NCSC asks for one of two settings: throttling, so that "You should allow no more than 10 guesses in 5 minutes", or "locking devices after no more than 10 unsuccessful attempts". Where the vendor does not let you change this, the vendor's default setting is accepted.
Length matters too. A credential used only to unlock the device needs "a minimum password or PIN length of at least 6 characters". If the same credential also signs the user in to organisational data or services, the full password rules in user access control apply instead. The A5.10 guidance repeats this: a 6-character PIN is only acceptable where it "does not provide access to organisational data and services without further authentication."
A5.9 asks whether a locking mechanism is set, and A5.10 asks which unlock method you use.
Common mistakes
- Allowing 4-digit PINs on phones. The minimum is 6.
- Using the unlock password as the network sign-in without meeting the full password rules.
- Setting the lock on company phones but not on personal phones that reach work data.
See the secure configuration requirements, question A5.10 and the iOS and iPadOS setup guide. Related: biometrics, account lockout, throttling.
Related terms
- BiometricsBiometrics means using a part of your body, such as a fingerprint or your face, to prove who you are instead of typing a password.
- Account lockoutAccount lockout is a setting that blocks further login attempts after a set number of wrong passwords or PINs, so a guesser cannot keep trying.
- ThrottlingThrottling is a setting that makes you wait longer after each wrong password or PIN, so guessing becomes slow enough to be pointless.
- DevicesDevices, in Cyber Essentials, are all types of hosts, networking equipment, servers, networks and end user devices such as laptops, tablets and smartphones, whether physical or virtual.
- End of support (end of life)End of support is the date after which a vendor stops releasing security fixes for a product, so any new flaws found in it stay open for good.
- End-user device (EUD)An end-user device is any computer, tablet, phone or thin client that a person uses directly to do their work.
Frequently asked questions
Device unlocking is the check, such as a PIN, password, fingerprint or face scan, that a person must pass before they can use a laptop, phone or tablet. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, device unlocking comes up at A5.9, A5.10. Read those questions against the definition above so your answers use the term the way the assessor will.
Device unlocking relates to 2. Secure Configuration in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.