Phones and tablets in Cyber Essentials: the main things each one must meet
Phones are full computers with your email on them, and the assessment treats them that way. Company or personal, every phone and tablet that touches work data has five main requirements — and one of them quietly retires old handsets.
Which devices this covers
Every phone and tablet used for work: company-owned ones, and personal ones that access work email, files or data — the BYOD rule decides which personal devices are in. The scope section (A2.8) asks for them with make and operating system; identical devices can be grouped with a quantity, but makes and versions must be real, because support status hangs on them. If you’re new to the scheme, start with how Cyber Essentials works.
1. A supported operating system — the one that retires handsets
Like laptops, a phone on an operating system that no longer receives security updates is an automatic fail anywhere in scope (A6.1). Phones leave support quietly: the maker simply stops shipping updates for older models, on schedules that vary by manufacturer. Check each device (iPhone: Settings → General → About; Android: Settings → About phone) against the maker’s published support dates. A handset that has aged out either gets replaced or stops being used for work — there is no setting that fixes it. It is one of the nine questions in the two-minute readiness check, which needs no account.
2. Updates on, within 14 days
Turn on automatic updates in Settings on every device. High-risk and critical security updates — and any whose severity the maker doesn’t say — must land within 14 days like everywhere else (A6.4), and automatic updates are how phones meet that without anyone thinking about it. Turn on automatic app updates in the App Store or Google Play settings too (A6.5.1) — that is a separate switch.
3. A real lock
Biometrics — fingerprint or face — are fine, but the passcode behind them must be at least 6 characters, and a 6-character PIN is only enough because it just unlocks the phone: work apps still need their own login with MFA (A5.9, A5.10). Four-digit passcodes don’t meet it. We suggest setting the screen to lock automatically after a few minutes idle. This is the control that matters most in the real world, because phones get left in taxis.
4. Official app stores and approved apps — that’s the malware control
Phones don’t need antivirus for Cyber Essentials. Their malware protection is application allow-listing: apps come only from the official App Store or Google Play, the device isn’t jailbroken or rooted (A8.1, A8.4), and you keep a list of approved work apps that people only install from (A8.5) — a short list in your BYOD policy is enough; MDM is optional. iPhones do this by default; on Android, keep “unknown sources” installation blocked. A jailbroken device in scope breaks the model and has no easy fix except restoring it.
5. The accounts on it follow the account rules
The mail app on a phone signs into the same Microsoft 365 or Google Workspace account as the laptop — so MFA on those accounts (A7.16, A7.17), individual logins, and prompt removal for leavers all apply through the phone too. When someone leaves, work accounts come off their device as part of the leaver process; on personal devices that means removing the work profile or account, not wiping their phone.
What Cyber Essentials does not ask of phones
No MDM requirement, no antivirus apps, no encryption checkbox, no ban on personal use of company phones. The five things above are the main ones, applied honestly to every device on the list — alongside removing apps and accounts nobody uses, keeping apps updated, and the approved-apps list. If you can say them for each phone in your asset register, you are well prepared for this part of the assessment.
Frequently asked questions
Which phones are in scope for Cyber Essentials?
Every phone and tablet used for work — company-owned, and personal ones that access work email, files or data. Personal devices used solely for the phone’s built-in calls and texts, or two-factor codes, are the only exemption.
What screen lock does a phone need?
Biometrics (fingerprint or face) are fine, but the passcode behind them must be at least 6 characters — and a 6-character PIN is only enough where it just unlocks the phone and work apps need their own sign-in. We suggest auto-lock when idle.
What happens when a phone stops getting updates?
An unsupported operating system anywhere in scope is an automatic fail, and phones leave support quietly — the maker just stops shipping updates. Check each model’s published support dates; an old phone may need replacing or retiring from work use.
Does Cyber Essentials require antivirus on phones?
No. On phones and tablets the malware control is normally met by application allow-listing: apps only from the official App Store or Google Play, on a device that isn’t jailbroken or rooted, and only apps on a list your business has approved (A8.4, A8.5).
Do I need to list every phone individually?
The scope section asks for phones and tablets with make and operating system. Identical devices can be grouped with a quantity; what matters is that makes and OS versions are real, because they decide support status.