Cyber Essentials: Staff Phones and Personal Laptops
If staff use a personal phone or laptop to access work information, check how that device fits your Cyber Essentials scope. Ownership alone does not settle the question. Start with how the device is used, then agree the controls and responsibilities with your IT provider and assessor.
On this page
Work use is the starting point
IASME’s scope guidance includes personal devices used to access organisational data and services, including work email. Its contractor guidance also explains why people outside the payroll can matter to the assessment.
For each device, describe the actual work it performs. A phone used for email, a contractor’s laptop accessing a shared drive and an organisation-owned computer at home may need different management arrangements. Ask the assessor about specific exceptions instead of applying a blanket rule.
Build a small device-use list
You can start with a spreadsheet containing:
| Record | Example of useful information |
|---|---|
| Work activity | Email, documents or access to a business application |
| Device owner | The organisation, a staff member or a contractor |
| Device type | Phone, tablet or laptop |
| Support | Who checks the operating system and applications? |
| Access | Who grants and removes work access? |
| Open question | Anything the provider or assessor needs to clarify |
Record only what is needed for the business review. Avoid gathering private photos, messages or personal account passwords.
Agree a workable approach with staff
Explain why the organisation needs to protect work information and what any proposed management will do. Staff should understand which business data or settings can be controlled and what happens when they leave.
Our practical recommendation is to write the agreement in everyday language. Include who supplies support, what happens if a device is lost and who to contact before replacing it. Check the technical behaviour of any management tool before describing it to staff.
Where a personal device cannot be managed appropriately, discuss another way to provide work access, such as an organisation-managed device. Confirm the resulting scope and controls with the assessor.
Where Intune can help
Device and application management may help implement an agreed approach. The appropriate setup depends on the platform, ownership, applications and licences. It should follow the business requirements rather than assuming the same policy suits every device.
Cloud365 can scope Intune setup and explain proposed changes before they are applied. Buying or enabling a tool does not, by itself, establish that every Cyber Essentials requirement has been met.
Check changes before renewal
A useful recurring question is: “Who has started using a different device for work?” Include new starters, contractors and replacement phones. Keep access-removal tasks connected to the device record when someone leaves.
Use the current Cyber Essentials resources and our requirements checklist to guide the wider review. If your certificate is approaching expiry, follow the renewal checklist.
Ask us to help clarify the next step
Tell us roughly how many people use personal devices, which kinds of devices are involved and whether you have a certificate or customer deadline. A short description is enough for an initial discussion. Leave device identifiers and sensitive documents out of the public form.
Ask about personal devices and Cyber Essentials. We will confirm the preparation work or device-management project needed before quoting.
Common questions
Are personal devices automatically outside Cyber Essentials scope?
No. Check what work information and services they access, then confirm the applicable scope and controls with your assessor.
Does using Intune guarantee certification?
No. Intune can support an agreed management approach, but certification depends on meeting the applicable requirements across the assessment scope.
Ask us for help
Tell us what you need
A short description is enough. We review enquiries within 2 business hours, Monday to Friday, 8am to 6pm UK time, excluding bank holidays.
Thanks, we have your enquiry
Your request is saved for our team. Jeet Singh is our Delivery Lead.
Need to add something? Email support@cloud365.io.
