Mobile device management (MDM)
Mobile device management is software that lets an organisation set up, secure and track its phones, tablets and laptops remotely from one console. Cyber Essentials does not require it. The A8.5 guidance says you may use MDM to control which apps users install, but good policy, processes and staff training can also meet the requirement.
- Term
- Mobile device management
- Also known as
- MDM, Unified endpoint management, UEM
- Category
- Devices and software
- Requirement area
- B. Definitions; 5. Malware protection
- Reviewed against
- Requirements v3.3
What does the term mobile device management mean in Cyber Essentials?
Mobile device management is software that lets an organisation set up, secure and track its phones, tablets and laptops remotely from one console.
How does mobile device management apply to Cyber Essentials?
In plain terms
Think of a fleet manager for company vans who can set rules for every vehicle, see which ones are overdue a service and immobilise one that is stolen, all without leaving the office. MDM does that for phones, tablets and laptops. Microsoft Intune and Jamf are common examples.
What Cyber Essentials asks
The NCSC definition of an organisational service includes MDM platforms and "mobile device management containers". That means the MDM platform is itself an in-scope service: the accounts that manage it need the same care as any other admin account.
A8.1 option B, application allow listing, gives MDM as one example of how to limit which apps users can install. A8.5 says: "You may use Mobile Device Management (MDM) software to meet this requirement but you are not required to use MDM software if you can meet the requirements using good policy, processes and training of staff."
In practice MDM makes several answers easier to show, because one policy can enforce a screen lock (A5.9), automatic updates (A6.4.1, A6.5.1) and an approved app list (A8.4, A8.5) across every device.
Common mistakes
- Creating a policy but not assigning it to every device. Check that the compliance report covers everything listed at A2.6 and A2.8.
- Enrolling company phones but forgetting personal phones that reach work data.
- Leaving the MDM console without MFA on its administrator accounts.
See the Microsoft Intune setup guide and BYOD scope rules. Related: BYOD, allow listing, organisational service.
Related terms
- BYOD (bring your own device)BYOD, short for bring your own device, means staff using their own personal phones, tablets or computers to do work.
- Allow listing (application allow listing)Allow listing is a malware protection option in which only approved applications, restricted by code signing, are allowed to execute on devices.
- Organisational serviceAn organisational service is any software application, cloud application, cloud service, user interactive desktop or mobile device management system your organisation owns or subscribes to.
- Open-source softwareOpen-source software is software whose source code is published for anyone to use, change and share under the terms of its licence, often at no cost.
- Operating system (OS)An operating system is the core software that runs a device and lets every other program work, such as Windows, macOS, iOS or Android.
- Patch managementPatch management is the routine an organisation follows to find, install and check software updates on every device and service it uses.
Frequently asked questions
Mobile device management is software that lets an organisation set up, secure and track its phones, tablets and laptops remotely from one console.
In the 2026 Danzell question set, mobile device management comes up at A8.1, A8.5. Read those questions against the definition above so your answers use the term the way the assessor will.
Mobile device management relates to B. Definitions; 5. Malware protection in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.