Jailbreaking and rooting
Jailbreaking (on iPhones and iPads) and rooting (on Android) mean removing the maker's built-in restrictions so the owner can install anything and change system files. The A8.4 guidance notes that you usually have to root or jailbreak a device to allow unsigned apps, which Cyber Essentials allow listing forbids. Such a device undermines A8.4.
- Term
- Jailbreaking and rooting
- Also known as
- Jailbreak, Jailbroken, Rooting, Rooted device
- Category
- Devices and software
- Requirement area
- 5. Malware protection
- Reviewed against
- Requirements v3.3
What does the term jailbreaking and rooting mean in Cyber Essentials?
Jailbreaking (on iPhones and iPads) and rooting (on Android) mean removing the maker's built-in restrictions so the owner can install anything and change system files.
How does jailbreaking and rooting apply to Cyber Essentials?
In plain terms
Phone makers keep apps inside a walled garden. Apps come from the official store, they are checked, and they carry a digital signature that proves where they came from. Jailbreaking or rooting knocks a hole in that wall. The owner gains full control, and so does any app they install, including ones nobody has checked.
What Cyber Essentials asks
Most phones and tablets meet the malware protection control through application allow listing (A8.1 option B). The NCSC says "Only approved applications, restricted by code signing, are allowed to execute on devices" and that "users must not be able to install any application that is unsigned or has an invalid signature".
A8.4 asks: "Where you use an app-store or application signing, are users restricted from installing unsigned applications?" The IASME guidance explains the link: "Some operating systems which include Windows, Chromebooks, mobile phones and tablets restrict you from installing unsigned applications. Usually you have to "root" or "jailbreak" a device to allow unsigned applications." A jailbroken or rooted phone no longer has that restriction.
Common mistakes
- Forgetting personal phones. A BYOD phone that reaches work email is in scope, and your policy needs to cover it.
- Relying on trust alone. MDM compliance policies can be set to block jailbroken or rooted devices, for example in Microsoft Intune.
See the malware protection requirements and the Android and iOS and iPadOS setup guides. Related: allow listing, mobile device management, BYOD.
Related terms
- Allow listing (application allow listing)Allow listing is a malware protection option in which only approved applications, restricted by code signing, are allowed to execute on devices.
- Mobile device management (MDM)Mobile device management is software that lets an organisation set up, secure and track its phones, tablets and laptops remotely from one console.
- BYOD (bring your own device)BYOD, short for bring your own device, means staff using their own personal phones, tablets or computers to do work.
- Licensed and supported softwareLicensed and supported software is software you have a legal right to use and that a vendor supports with regular vulnerability fixes until a published end date.
- Long-term support (LTS)Long-term support is a version of a product that the vendor commits to keep fixing for several years, rather than the shorter period a normal release gets.
- MacrosA macro is a small program saved inside a document or spreadsheet that automates tasks, and it can run as soon as the file is opened.
Frequently asked questions
Jailbreaking (on iPhones and iPads) and rooting (on Android) mean removing the maker's built-in restrictions so the owner can install anything and change system files.
In the 2026 Danzell question set, jailbreaking and rooting comes up at A8.1, A8.4. Read those questions against the definition above so your answers use the term the way the assessor will.
Jailbreaking and rooting relates to 5. Malware protection in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.