iOS and iPadOS settings for Cyber Essentials
Five controls, in scheme order, with the setting path and question number for every step. Applies to iOS 26 and iPadOS 26 (paths checked against Apple Support).
An iPhone or iPad meets Cyber Essentials when it runs an iOS or iPadOS version Apple still patches, has a passcode of at least 6 digits, installs updates automatically, and can only install approved apps from the App Store. Phones and tablets use application allow listing (option B) for malware protection, because v3.3 limits anti-malware software to Windows and macOS.
- Platform
- iOS and iPadOS (Apple)
- Applies to
- iOS 26 and iPadOS 26 (paths checked against Apple Support)
- Paths last checked
- 2026-11
- Controls covered
- Firewalls, Secure configuration, Security update management, User access control, Malware protection
- Steps
- 12 settings across 5 controls
- Reviewed against
- Requirements v3.3 and the Danzell question set v16.3
A4: how do you configure iOS and iPadOS for firewalls?
Apply 2 settings in iOS and iPadOS: record the device in scope and turn off unneeded network services. Together they provide evidence for A2.8 and A5.1.
A4.1.1 asks about software firewalls on computers, laptops and servers, not phones and tablets, and iOS has no user-configurable firewall. Record each device in A2.8 and turn off network services you do not use. See the firewalls requirements for what the control asks.
Record the device in scope
A2.8Settings > General > About > Model Name and iOS Version (for the A2.8 device list)Turn off unneeded network services
A5.1Control Centre > touch and hold the connectivity controls > AirDrop: Receiving Off or Contacts Only; Settings > General > AirPlay & Continuity > Automatically AirPlay: Never
A5: how do you configure iOS and iPadOS for secure configuration?
Apply 3 settings in iOS and iPadOS: set a passcode of at least 6 digits, set auto-lock and keep brute-force protection on. Together they provide evidence for A5.9, A5.10 and A7.10.
Requirements v3.3 need a credential before anyone can use the device, a minimum of 6 characters for a passcode that only unlocks the device, and protection against brute-force guessing. See the secure configuration requirements for what the control asks.
Settings > Face ID & Passcode (or Touch ID & Passcode) > Turn Passcode On > keep the default 6-digit code, or Passcode Options: Custom Numeric Code or Custom Alphanumeric CodeDo not choose 4-Digit Numeric Code. Face ID or Touch ID is fine as the everyday unlock because a passcode is always required behind it.
Set auto-lock
A5.9Settings > Display & Brightness > Auto-Lock: 2 minutes or lessSettings > Face ID & Passcode > Erase Data: On (or rely on the built-in escalating delay between failed attempts)iOS adds a growing delay after repeated wrong passcodes, which meets the throttling option. Where a setting cannot be changed, v3.3 says to use the vendor default.
A6: how do you configure iOS and iPadOS for security update management?
Apply 3 settings in iOS and iPadOS: turn on automatic updates, confirm the version is still patched and auto-update apps. Together they provide evidence for A6.4.1, A6.4, A6.1, A6.5.1 and A6.5.
Apple publishes no end-of-support dates, so check its security releases page. On 26 October 2026 Apple shipped security updates for iOS 27, iOS 26 and iOS 18. Apple states that only the latest major version receives every fix, so keep devices on iOS 27 where the hardware allows. See the security update management requirements for what the control asks.
Turn on automatic updates
A6.4.1A6.4AUTO-FAILSettings > General > Software Update > Automatic Updates > iOS Updates: Automatically Install: On; System Files: Automatically Install: OnAutomatic install waits for the device to be charging and on Wi-Fi overnight. Check the version on devices that rarely charge overnight.
Confirm the version is still patched
A6.1Settings > General > About > iOS Version (compare against Apple's security releases page)Auto-update apps
A6.5.1A6.5AUTO-FAILSettings > Apps > App Store > App Updates: On
A7: how do you configure iOS and iPadOS for user access control?
Apply 2 settings in iOS and iPadOS: use an authenticator app or passkeys for MFA and enrol company and BYOD devices in MDM. Together they provide evidence for A7.17, A2.8, A5.9 and A7.3.
Phones are single-user devices. The user access controls are the device passcode, MFA on the cloud services the phone reaches, and keeping work accounts under organisational control. See the user access control requirements for what the control asks.
Use an authenticator app or passkeys for MFA
A7.17AUTO-FAILInstall Microsoft Authenticator or Google Authenticator and enrol work accounts, or save passkeys in the Passwords appA phone used only as an MFA authenticator, for native calls or for native texts is out of scope under v3.3. Once it opens work email or files it is in scope.
Company devices: Apple Business (formerly Apple Business Manager) > assign to your MDM (automated device enrolment); BYOD: Settings > General > VPN & Device Management > Sign In to Work or School Account, using a Managed Apple Account (account-driven User Enrolment)MDM lets you enforce the passcode, report the OS version and remove work data from leavers' devices.
A8: how do you configure iOS and iPadOS for malware protection?
Apply 2 settings in iOS and iPadOS: limit installs to approved apps and block alternative app marketplaces. Together they provide evidence for A8.4 and A8.5.
A8.1 lists anti-malware software as an option only for Windows and macOS devices, so iPhones and iPads use option B: application allow listing. The App Store's code signing covers A8.4; your approved app list covers A8.5. See the malware protection requirements for what the control asks.
Block alternative app marketplaces
A8.4MDM > Restrictions > Allow app installation from an alternative marketplace: Off (eligible regions only)UK-region devices cannot install from alternative marketplaces, but staff who travel or hold EU accounts can.
Which questions does this guide cover?
The 14 questions below are the ones iOS and iPadOS can provide evidence for. Use the step names in your notes field. Any question not listed still needs answering from your other devices, firewalls and cloud services.
| Question | What it asks | Steps in this guide |
|---|---|---|
| A2.8 | Please list the quantities of tablets and mobile devices within the scope of this assessment. | A4: Record the device in scope; A7: Enrol company and BYOD devices in MDM |
| A5.1 | Have you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services? | A4: Turn off unneeded network services |
| A5.10 | Which method do you use to unlock the devices? | A5: Set a passcode of at least 6 digits; A5: Keep brute-force protection on |
| A5.9 | When a device requires a user to have the device in hand, do you set a locking mechanism on your devices to access the software and services installed? | A5: Set a passcode of at least 6 digits; A5: Set auto-lock; A7: Enrol company and BYOD devices in MDM |
| A6.1 | Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes? | A6: Confirm the version is still patched |
| A6.4AUTO-FAIL | Are all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release? | A6: Turn on automatic updates |
| A6.4.1 | Are all updates applied for operating systems by enabling auto updates? | A6: Turn on automatic updates |
| A6.5AUTO-FAIL | Are all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release? | A6: Auto-update apps |
| A6.5.1 | Are all updates applied on your applications by enabling auto updates? | A6: Auto-update apps |
| A7.10 | Where you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks? | A5: Keep brute-force protection on |
| A7.17AUTO-FAIL | Has MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it? | A7: Use an authenticator app or passkeys for MFA |
| A7.3 | How do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation? | A7: Enrol company and BYOD devices in MDM |
| A8.4 | If Option B has been selected: Where you use an app-store or application signing, are users restricted from installing unsigned applications? | A8: Limit installs to approved apps; A8: Block alternative app marketplaces |
| A8.5 | If Option B has been selected: Where you use an app-store or application signing, do you ensure that users only install applications that have been approved by your organisation and do you maintain this list of approved applications? | A8: Limit installs to approved apps |
What evidence should you keep for the assessor?
Keep the 4 dated records listed below for iOS and iPadOS. They back up your notes fields and are what an assessor asks to see if an answer needs clarifying.
The self-assessment does not upload screenshots, but the notes fields must describe how each control is met, and Cyber Essentials Plus checks the configuration directly. Keep them in one folder, dated, and refresh them before each annual renewal. If you want the settings checked against the question set before you submit, a gap analysis covers it.
- MDM device inventory showing model, iOS version and passcode compliance for every device in A2.8.
- MDM restriction profile showing app installation limits and the approved app list.
- Screenshot of Software Update > Automatic Updates on a sample device.
- A dated check of Apple's security releases page confirming the versions in use are still patched.
Related guides and requirements
- Firewalls requirementsThe control hub behind the first section of this guide.
- A7.16 and A7.17: MFA on cloud servicesThe automatic-fail questions most setup gaps lead to.
- Check your readinessFree checker that asks the auto-fail questions first.
- BYOD and Cyber Essentials scopeWhich staff-owned phones are in scope.
- A8.1: malware protection optionsWhy phones use application allow listing.
- Glossary: device unlockingThe 6-character rule and brute-force protection.
- AndroidMobile
- Supported software listEnd-of-support dates for operating systems and applications.
- Cyber Essentials Plus: how to prepareWhat the tester checks on the day.
Frequently asked questions
No. Requirements v3.3 put mobile devices used only for native voice calls, native text messages or MFA applications out of scope. The moment a phone also reads work email or opens organisational documents, it is in scope and must meet all five controls.
Apple publishes no end dates. As of November 2026, iOS 27, iOS 26 and iOS 18 all received security updates on 26 October 2026, so devices on those versions can be answered as supported in A6.1. Apple warns that only the latest version gets every fix, so upgrade where you can. iOS 17 and earlier no longer receive updates.
No. Requirements v3.3 offer anti-malware software only for Windows and macOS devices. iPhones and iPads use application allow listing: apps must be code signed and approved, and users must not be able to install anything else. Answer option B in A8.1 and the follow-up questions A8.4 and A8.5.
No single platform covers the whole assessment. Cyber Essentials applies to every in-scope device, cloud service and network boundary. This guide covers what this platform can evidence; you still need to answer the scope questions in A2 and cover any other devices, firewalls and cloud services you use.
The self-assessment is declarative. You answer the questions and write notes; screenshots are not uploaded. Keep them anyway. They let you answer the notes fields precisely, they speed up Cyber Essentials Plus, and they are what an assessor asks for if an answer needs clarifying.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026Read on iasme.co.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials Plus Test Specification v3.2Read on ncsc.gov.uk (opens in a new tab)
- support.apple.comApple Support: Set a passcode on iPhoneRead on support.apple.com (opens in a new tab)
- support.apple.comApple Support: Update your iPhone or iPadRead on support.apple.com (opens in a new tab)
- support.apple.comApple Support: Apple security releasesRead on support.apple.com (opens in a new tab)
- support.apple.comApple Platform Deployment: About software updates for Apple devicesRead on support.apple.com (opens in a new tab)