Cyber Essentials Mobile Device Requirements: Phones and Tablets

Cyber Essentials mobile device requirements apply to every phone and tablet that accesses your organisational data or services, such as email, Microsoft Teams or a business app. Under the NCSC’s Requirements for IT Infrastructure v3.3, each one must run a supported operating system, install high-risk and critical updates within 14 days, lock with a biometric, password or PIN of at least 6 characters, and run only approved, code-signed apps.

Phones are easy to overlook: an old handset that no longer gets updates, a 4-digit PIN, or an app from outside the official store. Which personally owned (BYOD) phones fall into scope is covered in our Cyber Essentials scoping questionnaire, and the rules for other device types are in our Cyber Essentials checklist.

Do phones and tablets count for Cyber Essentials?

Yes, if they access organisational data or services. v3.3 lists tablets and smartphones as devices; organisational data includes email, and organisational services include cloud apps and mobile device management (MDM) solutions. Mobile devices used only for native voice calls, native text messages or an MFA app are out of scope.

What are the Cyber Essentials mobile device requirements?

Four of the five controls name tablets and mobile phones in the devices they apply to. The firewall control’s list covers boundary firewalls, computers, routers, servers and cloud services, so for phones and tablets the work falls under the other four.

Which iOS and Android versions does Cyber Essentials accept?

There is no fixed list of versions. All software in scope must be licensed and supported, meaning its vendor has committed to regular vulnerability fixes. The question set asks for the make and operating system version of every in-scope phone and tablet, but not the model. Listing one on an unsupported operating system fails the assessment automatically, and if you give exact version numbers, a device behind a release more than 14 days old will be checked against the 14-day rule. When a phone stops receiving security updates, upgrade or replace it, or stop it accessing organisational data and services so it falls out of scope.

Apple doesn’t publish end-of-support dates in advance. Keep iPhones and iPads on a version Apple is still updating, ideally the latest major release, and plan to replace devices that can’t move to it. If you rely on older Apple devices, talk to us before you submit.

On Android, support depends on the make and model. Many manufacturers publish how long each model will receive security updates; record that date in your asset list so you can replace handsets before support ends.

How quickly must phones be updated for Cyber Essentials?

Within 14 days of release, for any update that fixes a vulnerability the vendor rates critical or high risk, that has a CVSS v3 base score of 7 or above, or where the vendor gives no severity. Since the April 2026 question set, missing the 14-day deadline is an automatic fail. The rule is explained in full under security update management.

In practice, treat every phone and tablet security update as due within 14 days:

• Apple. Apple’s security notes describe each fix but don’t give a severity rating, so iOS and iPadOS security updates fall under the “no severity given” part of the rule.
• Android. Google’s monthly Android security bulletins rate each fix and often include fixes rated high or critical. Your manufacturer’s update may arrive later, so check the security update date on each device.
• Apps. App updates count too. Turn on automatic updates in the App Store and Google Play, and remove apps that are no longer supported.

What screen lock does Cyber Essentials require?

A credential must be in place before anyone can use the device: a biometric, password or PIN. It must be protected against brute force, either by throttling (no more than 10 guesses in 5 minutes, with the wait growing after each failure) or by locking after no more than 10 failed attempts. Where the vendor doesn’t let you configure either, its default setting is accepted.

A PIN or password used only to unlock the device needs at least 6 characters. If the same credential also signs the user in to organisational services, the full Cyber Essentials password policy rules apply. Both iOS and Android let users choose a 4-digit PIN, so set 6 digits as your minimum, through MDM if you have it or by checking each device.

Cyber Essentials doesn’t set a screen lock time. A short auto-lock is sensible, but it isn’t a requirement.

Do phones need antivirus for Cyber Essentials?

No. In v3.3, anti-malware software is the option for devices running Windows or macOS. Phones and tablets use the other option, application allow listing: only approved applications, restricted by code signing, are allowed to run. You must approve apps before deploying them, keep a current list of approved apps, and stop users installing any app that is unsigned or has an invalid signature. For phones and tablets that means:

• Apps come only from the Apple App Store, Google Play or your MDM’s managed app catalogue.
• On Android, permission to install unknown apps stays off.
• No jailbroken or rooted devices, because they bypass code signing. MDM can detect and block them.

Is mobile device management required for Cyber Essentials?

No. An organisation with a few phones can meet every rule by configuring each one, but MDM makes the rules easier to enforce and evidence as numbers grow. Because v3.3 counts MDM solutions as organisational services, the MDM console itself is in scope, and a cloud-hosted console needs MFA on its admin accounts.

If you use Microsoft 365, our Cyber Essentials Microsoft 365 guide shows how Intune policies map to the controls.

What should you do if a phone is lost or stolen?

Cyber Essentials has no specific lost-device rule, but the device lock stops casual access, and v3.3 requires a process to change passwords promptly when you suspect an account is compromised. A simple routine:

1. The user reports the loss to a named person the same day.
2. Lock or wipe the device remotely through MDM or the platform’s find-my-device service.
3. Sign the user out of all sessions and change passwords for accounts used on the device.
4. Update your asset list and replace the device with a supported model.
5. Decide whether it is a personal data breach. Under UK GDPR, a breach must be reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people’s rights and freedoms. See the ICO’s breach reporting guidance.

How does Cyber Essentials Plus test mobile devices?

Phones and tablets are sampled by operating system version, like laptops, and the assessor runs the relevant tests from the NCSC’s Cyber Essentials Plus test specification:

Book the device owners for the audit day, update every phone beforehand and keep versions consistent, because each extra version adds to the sample. Sample sizes are in our Cyber Essentials Plus requirements guide.

Why Sovereign Secure?

Sovereign Secure Ltd is an IASME-licensed Cyber Essentials certification body, issuing Cyber Essentials and Cyber Essentials Plus certificates. We are ISO 27001 certified and a PCI SSC Qualified Security Assessor (QSA) company. Every Cyber Essentials package includes a pre-assessment check and a support call of up to an hour, so an out-of-date phone is found before you submit.

Ready to certify?

Not sure every handset passes? Our free Cyber Essentials readiness check takes about five minutes and flags the answers that fail automatically, including updates missed by more than 14 days. If your phones and tablets meet the rules above, choose a package on our Cyber Essentials cost page, with prices from £320 + VAT. Unsure about a particular device? Call +44 161 523 5276 and speak to an assessor.