Is BYOD in Scope for Cyber Essentials? Staff Phones and Laptops Explained
Short answer: yes, usually. Under Cyber Essentials, any personal device that accesses your business data or services is in scope. That includes a member of staff's own phone with Outlook or Teams on it.
This is one of the most common surprises for small businesses, and one of the most common reasons for failing.
When a personal device is in scope
| Device use | In scope? |
|---|---|
| Personal phone with work email, Teams, Slack or business apps | Yes |
| Personal laptop used to open work files or log into business systems | Yes |
| Home or remote worker's own device used for work | Yes |
| Phone used only for calls and texts (native apps) | No |
| Phone used only for an MFA authenticator app | No |
| Contractors' and customers' own devices | No |
Who counts as staff?
Personal devices are in scope for employees, volunteers and trustees. They're out of scope for contractors, MSP administrators and customers, but you're still responsible for making sure those devices access your data safely.
What each BYOD device needs
- An operating system the vendor still supports and updates
- High and critical updates installed within 14 days
- A screen lock: PIN, password or biometric, at least 6 characters
- Lockout or slowdown after no more than 10 wrong attempts
- Apps installed only from the official app store (phones and tablets)
- Anti-malware switched on (Windows and macOS laptops)
- A software firewall switched on (laptops)
Your three options
1. Include BYOD and make each device compliant
The most common route. List every personal device in your inventory and check each one against the requirements above.
2. Use a managed container
Mobile device management (MDM) can separate work data into a managed container on a personal device, which makes it easier to enforce the controls consistently.
3. Move work off personal devices
If a personal phone is too old to update, the simplest fix is to remove work email and apps from it, so it's out of scope.
Home routers
Routers supplied by a home worker's internet provider are out of scope. That means the firewall control must be met on the device itself, with the software firewall switched on. If you provide the home worker's router, it's in scope.
Get your scope right first time
The Readiness Pack includes a full scoping table, a device inventory sheet for BYOD, and a 5-control checklist.
Get the Readiness Pack from £24Source: NCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026). Always check the latest version before you apply.