Check your readiness
Mobile · Google and device manufacturers

Android settings for Cyber Essentials

Five controls, in scheme order, with the setting path and question number for every step. Applies to Android 16 on Pixel and Samsung One UI 8 (paths checked against Google and Samsung support pages).

Reviewed against vendor docs 2026-11
Updated 3 November 2026
Short answer

An Android phone meets Cyber Essentials when its manufacturer still issues security patches for that model, the screen lock needs a PIN or password of at least 6 characters, system and app updates install within 14 days, and only approved Google Play apps can be installed. Support depends on the manufacturer's patch commitment for the model, not the Android version.

Key facts
Platform
Android (Google and device manufacturers)
Applies to
Android 16 on Pixel and Samsung One UI 8 (paths checked against Google and Samsung support pages)
Paths last checked
2026-11
Controls covered
Firewalls, Secure configuration, Security update management, User access control, Malware protection
Steps
14 settings across 5 controls
Reviewed against
Requirements v3.3 and the Danzell question set v16.3

A4: how do you configure Android for firewalls?

Apply 2 settings in Android: record make, model, version and patch level and turn off unneeded sharing. Together they provide evidence for A2.8, A6.1 and A5.1.

A4.1.1 asks about software firewalls on computers, laptops and servers, not phones. Record make, model, Android version and patch level for A2.8 and switch off sharing services you do not use. See the firewalls requirements for what the control asks.

  1. Record make, model, version and patch level

    A2.8A6.1
    Settings > About phone > Model; Settings > About phone > Android version > Android version and Android security update

  2. Turn off unneeded sharing

    A5.1
    Settings > search Quick Share > Who can share with you: Your devices or Contacts, never Everyone (Samsung: Settings > Connected devices > Quick Share)

A5: how do you configure Android for secure configuration?

Apply 3 settings in Android: set a PIN or password of at least 6 characters, set the lock timeout and keep developer options and USB debugging off. Together they provide evidence for A5.9, A5.10 and A5.1.

A screen lock that needs a credential of at least 6 characters, a short timeout, and no settings that let files or apps run without the user approving them. See the secure configuration requirements for what the control asks.

  1. Set a PIN or password of at least 6 characters

    A5.9A5.10
    Settings > Security & privacy > Device unlock > Screen lock > PIN (6 digits or more) or Password (Samsung: Settings > Lock screen and AOD > Screen lock type)

    Pattern unlock is not a 6-character credential. Fingerprint or face unlock is fine on top of a PIN.

  2. Set the lock timeout

    A5.9
    Settings > Display > Screen timeout: 2 minutes or less; Settings > Security & privacy > Device unlock > Screen lock > Settings (gear) > automatic lock timing: Immediately

  3. Keep developer options and USB debugging off

    A5.1
    Settings > System > Developer options > USB debugging: Off, then turn Developer options off

A6: how do you configure Android for security update management?

Apply 4 settings in Android: install system updates automatically, apply each manufacturer update within 14 days, keep Google Play system updates current and auto-update apps. Together they provide evidence for A6.4.1, A6.4, A6.1, A6.5.1 and A6.5.

Google's November 2026 Android Security Bulletin lists fixes for Android 14, 15, 16 and 17. Whether a particular phone gets them depends on its manufacturer, so check the manufacturer's published support period for each model in scope. See the security update management requirements for what the control asks.

  1. Install system updates automatically

    A6.4.1
    Settings > System > Software updates (most system updates and security patches install automatically); Samsung: Settings > Software update > Auto download over Wi-Fi: On

  2. Apply each manufacturer update within 14 days

    A6.4AUTO-FAILA6.1
    Settings > About phone > Android security update (compare with the date the manufacturer released the update for that model)

    The 14 days in A6.4 run from when the update is released for your device, not from Google's bulletin date. A patch level many months old usually means the model is no longer supported.

  3. Keep Google Play system updates current

    A6.4AUTO-FAIL
    Settings > About phone > Android version > Google Play system update

  4. Auto-update apps

    A6.5.1A6.5AUTO-FAIL
    Play Store > profile picture > Settings > Network preferences > Auto-update apps: Update over Wi-Fi only, or Update all apps over Wi-Fi or mobile data

A7: how do you configure Android for user access control?

Apply 2 settings in Android: use an authenticator app or passkeys for MFA and use a work profile for BYOD. Together they provide evidence for A7.17, A2.8, A5.9 and A7.3.

Single-user devices. The controls are the lock credential, MFA on the cloud services the phone reaches, and keeping work data in a managed profile. See the user access control requirements for what the control asks.

  1. Use an authenticator app or passkeys for MFA

    A7.17AUTO-FAIL
    Install Microsoft Authenticator or Google Authenticator and enrol work accounts, or use passkeys stored in Google Password Manager

  2. Use a work profile for BYOD

    A2.8A5.9A7.3
    Intune Company Portal or Google endpoint management > set up a work profile (Android Enterprise)

    A work profile separates organisational data, applies your passcode and app policy, and can be removed when someone leaves.

A8: how do you configure Android for malware protection?

Apply 3 settings in Android: block installs from unknown sources, keep Play Protect on and approve apps through managed Google Play. Together they provide evidence for A8.4, A8.1 and A8.5.

A8.1 lists anti-malware software as an option only for Windows and macOS, so Android phones use option B: application allow listing. Blocking unknown sources and approving apps through managed Google Play is the evidence. See the malware protection requirements for what the control asks.

  1. Block installs from unknown sources

    A8.4
    Settings > Apps > Special app access > Install unknown apps > each app: Allow from this source: Off; Samsung: Settings > Security and privacy > Auto Blocker: On; or the MDM restriction

  2. Keep Play Protect on

    A8.1
    Play Store > profile icon > Play Protect > Settings > Scan apps with Play Protect: On

    Play Protect checks apps against Google's signals. It supports option B; it is not the anti-malware software option, which v3.3 limits to Windows and macOS.

  3. Approve apps through managed Google Play

    A8.5
    MDM > Apps > Managed Google Play > approve and assign apps; work profile users see only the approved list

Which questions does this guide cover?

The 14 questions below are the ones Android can provide evidence for. Use the step names in your notes field. Any question not listed still needs answering from your other devices, firewalls and cloud services.

QuestionWhat it asksSteps in this guide
A2.8Please list the quantities of tablets and mobile devices within the scope of this assessment.A4: Record make, model, version and patch level; A7: Use a work profile for BYOD
A5.1Have you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services?A4: Turn off unneeded sharing; A5: Keep developer options and USB debugging off
A5.10Which method do you use to unlock the devices?A5: Set a PIN or password of at least 6 characters
A5.9When a device requires a user to have the device in hand, do you set a locking mechanism on your devices to access the software and services installed?A5: Set a PIN or password of at least 6 characters; A5: Set the lock timeout; A7: Use a work profile for BYOD
A6.1Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes?A4: Record make, model, version and patch level; A6: Apply each manufacturer update within 14 days
A6.4AUTO-FAILAre all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?A6: Apply each manufacturer update within 14 days; A6: Keep Google Play system updates current
A6.4.1Are all updates applied for operating systems by enabling auto updates?A6: Install system updates automatically
A6.5AUTO-FAILAre all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release?A6: Auto-update apps
A6.5.1Are all updates applied on your applications by enabling auto updates?A6: Auto-update apps
A7.17AUTO-FAILHas MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it?A7: Use an authenticator app or passkeys for MFA
A7.3How do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation?A7: Use a work profile for BYOD
A8.1Are all of your desktop computers, laptops, tablets and mobile phones protected from malware by either:A8: Keep Play Protect on
A8.4If Option B has been selected: Where you use an app-store or application signing, are users restricted from installing unsigned applications?A8: Block installs from unknown sources
A8.5If Option B has been selected: Where you use an app-store or application signing, do you ensure that users only install applications that have been approved by your organisation and do you maintain this list of approved applications?A8: Approve apps through managed Google Play

What evidence should you keep for the assessor?

Keep the 3 dated records listed below for Android. They back up your notes fields and are what an assessor asks to see if an answer needs clarifying.

The self-assessment does not upload screenshots, but the notes fields must describe how each control is met, and Cyber Essentials Plus checks the configuration directly. Keep them in one folder, dated, and refresh them before each annual renewal. If you want the settings checked against the question set before you submit, a gap analysis covers it.

  • MDM inventory of Android devices with make, model, Android version and security patch level.
  • The manufacturer's published update policy or end-of-support date for each model in scope.
  • MDM restriction profile showing unknown sources blocked, a passcode required and managed Google Play in use.
How assessors check this
An assessor reading your A6.4 or A7.16 notes wants the mechanism, not a yes. "Update ring with 0-day deferral and 7-day deadline, assigned to all devices" passes. "Updates are automatic" invites a clarification request.
Common failure
A policy exists but is assigned to nobody, or excludes the group that matters. Check assignments and exclusions before you answer yes; the Cyber Essentials Plus tester samples the devices and accounts you least expect.

Related guides and requirements

Frequently asked questions

Check the manufacturer's published update policy for that model, not the Android version. Google, Samsung and others publish the date security updates end for each device. A phone that no longer receives security patches is unsupported for A6.1 whatever version it runs, and fails A6.4 at the next critical fix.

Treat it as unsupported. Google's November 2026 Android Security Bulletin lists fixes for Android 14, 15, 16 and 17 only, so a phone stuck on Android 13 is no longer receiving platform fixes. Check the manufacturer's patch level as well: a phone on Android 14 or later can still be unsupported if its maker has stopped shipping updates.

No. Requirements v3.3 offer anti-malware software only for Windows and macOS devices. Android phones use application allow listing: block unknown sources so only signed Play Store apps install, and limit users to apps you have approved. Answer option B in A8.1, then A8.4 and A8.5.

No single platform covers the whole assessment. Cyber Essentials applies to every in-scope device, cloud service and network boundary. This guide covers what this platform can evidence; you still need to answer the scope questions in A2 and cover any other devices, firewalls and cloud services you use.

The self-assessment is declarative. You answer the questions and write notes; screenshots are not uploaded. Keep them anyway. They let you answer the notes fields precisely, they speed up Cyber Essentials Plus, and they are what an assessor asks for if an answer needs clarifying.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources