Cyber Essentials BYOD scope: user-owned devices
User-owned devices that access organisational data or services are in scope. The only exceptions are devices used solely for native voice, native text or MFA apps.
Cyber Essentials puts user-owned devices in scope whenever they access organisational data or services, such as email, files or Microsoft 365. The only BYOD devices out of scope are those used solely for native voice calls, native text messages or a multi-factor authentication app. In-scope BYOD must meet all five controls.
- Rule
- User-owned devices which access organisational data or services are in scope
- Exceptions
- Devices used only for native voice applications, native text applications, or MFA applications
- Controls that apply
- All five: firewalls, secure configuration, security updates, user access control, malware protection
- What changed in 2026
- No change to the BYOD rule in v3.3
- Source
- Requirements for IT Infrastructure v3.3, Section D(i), Bring your own device (BYOD)
When is a personal device in scope?
The requirements say that, in addition to mobile or remote devices owned by the organisation, user-owned devices which access organisational data or services are in scope. Organisational data means any electronic data belonging to your organisation, such as emails, documents and database data. Organisational services means any software applications, cloud applications, cloud services, user interactive desktops and mobile device management (MDM) platforms you own or subscribe to, for example Microsoft 365, Google Workspace or Citrix Desktop.
A personal phone with the Outlook app signed into a work mailbox is in scope. So is a home PC used to reach a virtual desktop.
What are the three BYOD exceptions?
Mobile or remote devices used only for the following purposes are out of scope:
- native voice applications
- native text applications
- multi-factor authentication (MFA) applications
Why does BYOD make the controls harder to evidence?
Centrally managed devices have a standard build, which makes certifying the controls straightforward. BYOD gives users freedom to customise, so consistent implementation is harder. The NCSC's advice is to use the organisational data and services definitions to enforce strong access policies, for example allowing access only from devices that meet a compliance policy in MDM or conditional access.
The NCSC publishes separate guidance on BYOD, and the requirements document points applicants to it.
How do I declare BYOD in the question set?
List user-owned phones and tablets in A2.8 with quantities and operating system versions, and laptops or desktops in A2.6. In A2.4.2 describe how remote workers connect. In A8.5 confirm that the approved-application rule is enforced on employee-owned devices as well, which the guidance says explicitly.
The A2.6 guidance is explicit that the device summary applies to both corporate and user-owned devices, and A2.8 says devices connecting to cloud services must be included. Only make and operating system version are needed, for example '14 x Apple iPhone, iOS 26'; the model is no longer required.
A2.6 also covers the case where some devices sit outside a declared sub-set but still reach a cloud service: those devices are excluded, but the user accounts they use on the cloud service must still meet the controls, including mandatory MFA.
What evidence should I keep for BYOD?
Enough to show the five controls on devices you do not own. Most organisations keep: a BYOD policy staff have accepted; a count of personal devices by make and operating system version, taken from device management or Entra ID sign-in reports; the minimum OS version and screen lock rule you enforce; the MFA policy covering every cloud service personal devices reach; and the approved app list. Mobile device management enrolment or app protection policies make this a report rather than a survey.
If you would rather keep personal devices out of scope, block them technically with conditional access so only managed devices can reach organisational data, and keep the policy export as evidence.
How do assessors check this?
Related requirements
Frequently asked questions
No. A device used only for a multi-factor authentication application is one of the three named exceptions, alongside devices used only for native voice or native text applications. Add the Outlook app to it and it comes into scope.
Not if those devices access organisational data or services. You can reduce BYOD scope by blocking personal devices technically, for example with conditional access rules that allow only compliant managed devices, so that no personal device can reach your data.
All five. In practice that means a supported OS updated within 14 days, a 6-character or longer unlock credential, MFA on cloud logins, no admin use for everyday tasks, and application allow listing through the app store and an approved list.
The requirements do not mandate MDM. A8.5 guidance says you may use MDM to meet the approved-application requirement but are not required to if good policy, process and training achieve it. MDM or app protection policies do make evidence much easier.
Yes. Any user-owned device that accesses organisational data or services, including webmail or Microsoft 365 in a browser, is in scope. It must run a supported operating system, have its software firewall on, have anti-malware or allow listing, and use MFA on the cloud services it reaches.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh