The one-page BYOD policy
If anyone reads work email on their own phone, that device is in scope — and this page is the policy that makes the rules real: three requirements, the narrow exemption, and a fair opt-out. It is the same document ReadyCert drafts, free to take.
Your BYOD policy
The .md file opens in Word, Google Docs and Notion. Nothing leaves your browser.
Personal Devices at Work — Your company
Adopted today. Applies to anyone using a personal phone, tablet or computer for work (email, files, or any of our cloud services).
If you use your own device for work, it has to meet the same Cyber Essentials rules as a company device:
1. Keep it updated. The device runs a current, supported operating system, with automatic updates on for the system and its apps. Security updates rated high-risk or critical — or not rated at all — are installed within 14 days.
2. Keep it locked. Fingerprint or face, backed by a password or PIN of at least 6 characters. Work apps still ask you to sign in with two-factor login.
3. Approved apps only. Work apps come from the App Store / Google Play, only from our list of approved apps, and the device isn't jailbroken or rooted.
4. Computers too. A personal laptop or desktop also has its built-in firewall switched on and anti-malware protection running (Microsoft Defender counts on Windows).
Personal devices used ONLY for the phone's built-in calls and texts (or just receiving two-factor codes) don't count as work devices and aren't covered by this policy.
If you'd rather not apply these to your personal device, that's fine — just don't use it for work.
What this policy does
The 2026 rules put a personal device in scope the moment it accesses work email, files or data, exempting only devices used solely for the phone’s built-in calls and texts, or two-factor codes. Once a device is in, it must meet the same requirements as company kit — all five controls. This policy states the ones that matter most on a personal device — a supported operating system with updates on, a real lock, only approved apps from the official stores, and a firewall and anti-malware on computers — in words a team actually reads, names the exemption precisely, and offers the honest alternative — a company device — for anyone who would rather keep work off their own phone. The BYOD guide explains the rule behind each line.
How to adopt it
- Check it is true first. A policy describes reality: if someone’s personal handset has aged out of support, decide — replace, or work stays off it — before the policy says every device is current.
- Put your name on it and date it. The generator above does both.
- Share it with everyone who uses their own device, and keep a note of who has seen it. New starters get it on day one.
- List the devices. Every in-scope personal device goes in the asset register with make and OS version, marked as personal.
Frequently asked questions
Does Cyber Essentials require a BYOD policy?
It requires in-scope personal devices to meet the same rules as company ones. A short written policy is the practical way to make that true and provable — it tells staff exactly what applies and records that they agreed.
What should a BYOD policy include for Cyber Essentials?
What in-scope personal devices must meet — all five controls apply, so for phones: a supported operating system with automatic updates, a lock (biometrics, password or a PIN of at least 6 characters), and apps only from the official store and your approved-apps list on a non-jailbroken device; for computers, also the built-in firewall and anti-malware. Plus the exemption for devices used solely for built-in calls and texts or two-factor codes, and the option of a company device for anyone who opts out.
Why one page?
Because people read one page. The scheme does not ask for length; it asks for the rules to be real on every in-scope device, and a short policy everyone has seen beats a long one nobody has.