Device locking for Cyber Essentials: the PIN, password and screen-lock rules
Every laptop, desktop, phone and tablet in scope needs a lock that someone at the device has to get past — a fingerprint, face, password or PIN. What trips people up are the numbers: at least 6 characters, no more than 10 guesses, and the case where a device PIN has to meet the full password rules instead.
What the questions ask (A5.9, A5.10)
A5.9 asks whether devices that need someone physically present have a locking mechanism before their software and services can be used; A5.10 asks which method unlocks them. The NCSC’s Requirements for IT Infrastructure (v3.3, April 2026) set out three things under “device unlocking credentials”: a credential — a biometric, password or PIN — must be in place; it must be protected against guessing; and how long it must be depends on what it unlocks. The rules cover company devices and the personal phones and laptops staff use for work, which are in scope too.
How long the PIN or password must be
| What the PIN or password does | Minimum |
|---|---|
| Only unlocks the device; work accounts sign in separately | 6 characters |
| Is also the sign-in to a work account (the device login is the work login) | The full password rules: multi-factor authentication, or at least 12 characters, or at least 8 with common passwords blocked automatically |
IASME’s secure-configuration FAQ puts it in one line: 6 characters when unlocking a device; 8 where common passwords are blocked automatically or MFA is in use; 12 in all other cases. A six-digit PIN meets the device-unlock minimum; there is no rule about mixing letters and symbols.
Fingerprint and face unlock count as the credential. Every device that offers them also keeps a PIN or password as the fallback, and anyone holding the device can choose the fallback — so that PIN needs to meet the 6-character minimum as well. The requirements name biometrics, passwords and PINs; a swipe pattern isn’t one of them, so on Android the safe choice is a PIN or password.
Protection against guessing
Whatever unlocks the device must be protected against brute-force guessing. Where you can configure it, use one of two settings: throttling, where the wait grows after each wrong attempt and no more than 10 guesses are possible in 5 minutes; or locking the device after no more than 10 failed attempts. Where the maker doesn’t let you change it, the maker’s default setting is used instead.
In practice, iPhones, iPads and Android phones add growing delays after wrong guesses by default, and Microsoft says a Windows Hello PIN is locked by the PC’s security chip after too many wrong attempts. The one worth checking by hand is a Windows PC that signs in with a password — the Windows 11 guide shows how to see and set its lockout threshold.
Device by device
- Windows 11: Settings → Accounts → Sign-in options. A Windows Hello PIN of at least 6 characters, and “If you’ve been away…” set so the PC asks again when it wakes from sleep.
- Mac: System Settings → Touch ID & Password for a login password of at least 6 characters, and Lock Screen → require the password soon after the screen saver starts or the display turns off.
- iPhone and iPad: Settings → Face ID (or Touch ID) & Passcode. The standard passcode is 6 digits; under Passcode Options, avoid “4-Digit Numeric Code”. Auto- Lock is under Display & Brightness.
- Android: Settings → Security (or Security & privacy) → Screen lock → a PIN of at least 6 digits, or a password. Screen timeout is under Display. Menu names vary by maker.
No time limit is set for the automatic lock — the requirement is that someone at the device has to unlock it before using it. A few minutes of no use is the sensible setting, because it is what makes the lock real when someone walks away from a desk or leaves a phone on a table.
When a device PIN has to be a full password
The 6-character minimum applies only when the credential just unlocks the device. When the same credential also signs the person in to a work account, the requirements say the full password rules apply to it. The usual example is a Windows PC joined to Microsoft 365 (Microsoft Entra ID), where the Windows password is the Microsoft 365 password: that one needs MFA, or 12 characters, or 8 with common passwords blocked — the password guide explains the three routes. A phone passcode is normally device-only: the mail and file apps sign in to the work account separately, with its own MFA.
Personal phones and laptops
A personal phone that opens work email or files is in scope and needs the same lock as a company one; one used only for calls, texts and two-factor codes is not. The simplest way to make the rule stick is to write it down: the free BYOD policy template includes the 6-character passcode rule, and the other free templates cover the rest of the paperwork. The phones and tablets guide has the other phone questions.
Frequently asked questions
What is the minimum PIN length for Cyber Essentials?
6 characters, when the PIN or password only unlocks the device. If the same credential also signs someone in to business data or services, the full password rules apply instead: multi-factor authentication, or at least 12 characters, or at least 8 with common passwords blocked automatically.
Is a 4-digit PIN allowed for Cyber Essentials?
No. A PIN used to unlock a device must be at least 6 characters. Phones and Windows PCs can be set to accept 4, so check each device, including personal phones used for work.
Do fingerprint and face unlock count?
Yes — the requirements name biometrics alongside passwords and PINs. The PIN or password behind the fingerprint or face is also a way to unlock the device, so it needs to meet the 6-character minimum too.
How many wrong guesses does Cyber Essentials allow?
Where it can be set: no more than 10 guesses in 5 minutes, with the wait growing after each wrong attempt, or the device locking after no more than 10 failed attempts. Where the maker doesn’t let you change it, use the maker’s default setting.
Does Cyber Essentials say how quickly a screen must lock?
No time is set. The requirement is that someone physically at the device has to unlock it before using it. Locking automatically after a few minutes of no use is the sensible way to make that true when people walk away.