Cyber Essentials BYOD rules in 2026: phones, laptops, personal devices

Cyber Essentials v3.3 defines scope by organisational data/services access and the explicit role/ownership exceptions. Employee, volunteer and trustee BYOD accessing work is in scope, apart from the native voice/text/MFA-only exceptions. The practical question is how to scope BYOD cleanly without certifying every personal phone in the company.

This guide walks through the rules as assessors apply them in 2026.

Assess devices accessing organisational data or services, including email, files, messaging, SaaS applications and virtual desktops. Apply the scheme's role/ownership table and explicit exceptions; ownership matters for third-party contractors and MSPs, as explained below. A lack of local storage is not itself an exemption.

In practice this means:

• A personal iPhone used to check work email: in scope.
• A personal laptop used to access SharePoint: in scope.
• A personal iPad used only for personal photos and no work apps: out of scope.
• A privately owned home router that your work laptop connects to: out of scope. An organisation-supplied router is in scope. Apply the firewall controls on the endpoint; a corporate VPN can put the internet boundary on the company or virtual/cloud firewall.

Devices used only for native voice, native text or MFA applications are out of scope under the NCSC v3.3 requirements. Access to organisational services, including virtual desktops, counts even without local file storage.

A sub-set is a separately managed part of the organisation segregated by a firewall or VLAN. Agree its boundary with the assessor; a BYOD policy or data-storage restriction does not create this boundary. For a no-BYOD policy, verify in practice that personal devices cannot access organisational data or services, for example:

• The device cannot open work email, calendar, or files.
• The device cannot access company SaaS (Slack, M365, Google Workspace, CRM, ticketing).
• The device cannot VPN into the corporate network.
• The device cannot store or sync any work document.

Actual access determines device scope, subject to the explicit native voice/text/MFA-only exceptions. "We told staff not to use personal phones for work" does not establish a segregated organisational sub-set. Unsupported software has a stricter exclusion condition: a defined sub-set preventing all traffic to or from the internet.

Under v3.3 (Danzell A2.5), normal home routers used by remote workers are explicitly out of scope. The Danzell assessor guide is unambiguous: "Details of routers and firewalls in the home environment must not be included." The boundary instead follows the device that touches organisational data; the device's software firewall handles enforcement against the home network.

What is in scope for a remote-working solicitor is therefore:

• The work laptop, with its software firewall enabled, default-deny on inbound, and configured so a standard user cannot disable it.
• The MDM or device-management posture if applied (Intune, Jamf, Conditional Access).
• The cloud services accessed (M365, Google Workspace, practice management).

Reliance on the software firewall for home and remote workers must be noted in A2.5 of the questionnaire. The Danzell guide expects something like: "Home and remote workers rely on the device's software firewall as the boundary; no home routers in scope."

Where the home router IS in scope: if the firm supplies a corporate router to the home worker (i.e., issues the router as managed kit, not the worker's own ISP-provided router), that router is corporate equipment and is in scope. Assess it as you would any office-edge device.

What does not work: saying "staff work from home, their router is their problem" without the software-firewall notes. The Danzell rule is clear that home routers are excluded, but the device-level firewall picture must be described.

The CE questionnaire asks: "Does the organisation permit BYOD?" If yes, it asks you to describe the policy and controls.

A clear answer looks like:

> "BYOD permitted for personal iOS and Android phones only, limited to access of M365 email and Teams. Personal devices are enrolled in Intune before access is granted; Intune applies the supported passcode and locking policies; we verify vendor support, required vulnerability fixes and actual policy coverage. Disk encryption and biometric unlock are additional local hardening choices. Personal laptops are not permitted to access work resources under any circumstances."

An unclear answer looks like:

> "We allow staff to use personal devices if they sign our acceptable-use policy."

An answer needs supporting evidence of actual coverage and controls. Neither sample wording guarantees acceptance.

Under v3.3, scope BYOD deliberately. Either exclude all personal devices with technical controls, or allow them under MDM / conditional access and put them in scope. The in-between - "personal devices allowed, policy-based" - does not pass assessment.

The good news: once scoped correctly, BYOD is straightforward to certify. The bad news: most organisations discover they are in-between on first review and need a small amount of remediation before their first CE submission passes.

Check your BYOD readiness | See the 14-day patching rule | Get certified in 6 hours