Personal devices and BYOD

A personal phone, tablet or computer is in scope for Cyber Essentials if it is used to access your organisational data or services. It must then meet the same five controls as a company device. The only exception is a personal device used solely for ordinary phone calls, text messages or an MFA app.

What "accessing organisational data or services" means

Requirements v3.3 defines both terms broadly:

• Organisational data is any electronic data that belongs to the organisation, such as email, documents, database records and financial data.
• Organisational services are the applications and services the organisation owns or subscribes to, such as Microsoft 365, Google Workspace, web applications, virtual desktops, IP telephony and mobile device management (MDM) containers.

So a personal phone with the Outlook app, Teams, or a browser signed in to the accounts system is in scope. A personal laptop used to reach a virtual desktop is in scope too; IASME's scope FAQ confirms devices that connect to VDI are included.

What is out of scope

A personal device is out of scope if it is used only for:

• native voice calls,
• native text messages (SMS), or
• an MFA app, such as an authenticator that approves sign-ins.

Once that device also opens work email or files, it comes back into scope.

Who the rule applies to

Version 3.3 includes a table of devices the organisation does not own. In summary:

Devices your organisation owns are in scope whoever uses them, including ones lent to a third party. For contractors and MSPs, their own devices are out of scope but the accounts you give them are in scope. You also remain responsible for checking that out-of-scope devices touching your data are set up properly, even though the assessment does not cover them.

Staff BYOD cannot be scoped out with a sub-set. IASME's guidance treats student BYOD as the one recognised exception, where students use a segregated network.

What an in-scope personal device needs

Each device needs all five controls, so in practice:

1. A supported operating system that still gets security updates, with updates installed within 14 days for critical and high fixes. Automatic updates on.
2. A screen lock using a PIN, password or biometric, with at least 6 characters for an unlock-only PIN, and lockout or throttling after repeated wrong guesses.
3. Malware protection. For laptops and desktops, anti-malware such as the built-in Microsoft Defender or macOS protections. For phones and tablets, installing apps only from the official store.
4. A software firewall turned on for laptops and desktops, since the home router is usually out of scope.
5. Unique accounts with MFA for every work cloud service, and no admin-level daily use.
6. Unneeded apps removed. A jailbroken or rooted phone gets round the app signing checks, so in practice it cannot meet the malware control.

Handling BYOD in practice

• Decide whether you will allow BYOD at all. Issuing company devices, or limiting personal phones to calls, texts and MFA, can shrink your scope considerably.
• If you allow it, write a short BYOD policy that lists the conditions above and get staff to agree to it.
• Use MDM or app protection policies where you can, so you can check versions and settings. Your assessor may ask how you know personal devices meet the controls.
• Record each personal device's make, model and operating system version in your assessment, as you would for company devices.

The readiness checker asks about personal devices and shows the checks that then apply.