A2.8: Which tablets and mobile phones are in scope?
Please list the quantities of tablets and mobile devices within the scope of this assessment.
Source: IASME Cyber Essentials Danzell question set v16.3
A2.8 needs the quantity, make and operating system version of every tablet and mobile phone in scope, corporate and BYOD, that connects to organisational data or cloud services. Models are not required. A scope without end user devices is not acceptable. Phones used only for native calls, texts or an MFA app are out of scope under v3.3.
Is A2.8 an automatic fail?
No. A2.8 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- Please Note: You must include make and operating system versions for all devices. All user devices within the scope of the certification only require the make and operating system to be listed.
- Requirement enforced
- Section D of the requirements: the scope must cover the whole IT infrastructure or a well-defined and separately managed sub-set, and cloud services cannot be excluded.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
What does A2.8 ask?
A2.8 asks: “Please list the quantities of tablets and mobile devices within the scope of this assessment.”
A2.8 asks for the quantities of tablets and mobile devices in scope. The guidance says you must include the make and operating system version for every device, that only the make and operating system are required, that devices connecting to cloud services must be included, and that a scope without end user devices is not acceptable.
The v3.3 BYOD rule decides which phones count. User-owned devices that access organisational data or services are in scope. Devices used only for native voice, native text or MFA applications are out of scope. A personal phone with Outlook, Teams or a work WhatsApp group linked to company data is in. See BYOD, and check versions on the iOS and Android support pages.
What should you write in the notes field for A2.8?
Write two to four specific sentences for A2.8: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
Corporate: [n] x Apple iPhone running iOS [version]; [n] x Samsung Galaxy running Android [version] (One UI [version]). BYOD: [n] x Apple iPhone running iOS [version]; [n] x Android phones from [makes] running Android [versions], accessing Outlook and Teams under [Intune app protection policy]. Phones used only for calls, texts and the authenticator app are excluded under the v3.3 BYOD rule.
Why do applicants fail A2.8?
A common reason applicants fail A2.8: leaving out personal phones that receive work email or Teams.
- Android phones on a version the manufacturer no longer patches, often older budget models.
- Writing 'iPhones' without operating system versions.
- Excluding phones that do more than calls, texts and MFA.
How do you fix a failing A2.8 answer?
If your answer to A2.8 would not pass today, fix the control first and then write the answer. In order:
- Export phones and tablets from MDM with OS versions, and ask staff which personal phones reach work email, Teams or files.
- Add those BYOD phones; leave out phones used only for calls, texts and an MFA app.
- Replace or remove any phone whose manufacturer has stopped issuing security updates.
How do assessors check A2.8?
What evidence should you keep for A2.8?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A2.8:
- An MDM export of phones and tablets with operating system versions, or a dated list of BYOD devices and their versions.
Where to go next
- BYOD and Cyber EssentialsWhich personal devices are in scope
- iOS supportSupport dates
- Android supportSupport dates
- Scope: what is in and outSection D of v3.3 explained
- Scope checklistBuild the A2 inventory
- All A2 questionsScope of assessment
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A2 questions
- A2.6.1A2.6.1NotesPlease list the quantity of thin clients within the scope of this assessment. Please include make and operating systems.Notes
- A2.7A2.7NotesPlease list the quantity of servers, virtual servers, virtual server hosts (hypervisors) and Virtual Desktop Infrastructure (VDI) servers. You must include the operating system.Notes
- A2.9A2.9NotesPlease list all the cloud services that are in use by your organisation and provided by a third party.Notes
- A2.10A2.10NotesPlease provide the name and role of the person who is responsible for managing your IT systems in the scope of this assessment.Notes
Frequently asked questions
A2.8 in the 2026 Danzell Cyber Essentials question set asks: "Please list the quantities of tablets and mobile devices within the scope of this assessment." It is a notes question, answered in free text.
A2.8 needs the quantity, make and operating system version of every tablet and mobile phone in scope, corporate and BYOD, that connects to organisational data or cloud services. Models are not required. A scope without end user devices is not acceptable. Phones used only for native calls, texts or an MFA app are out of scope under v3.3.
No. A2.8 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Yes, if they access organisational data or services such as work email, Teams or files. Under v3.3 they are out of scope only if used solely for native voice, native text or MFA applications.
Apple and Android manufacturers set their own support periods. A6.1 names iOS 15 and Android 12 as examples of unsupported versions. Check each make's current security update policy.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh