Source: https://cloud365.io/blog/cyber-essentials-personal-devices/

# Cyber Essentials: Staff Phones and Personal Laptops

4 November 2026 3 minute read By the cloud365.io team Updated 4 November 2026

If staff use a personal phone or laptop to access work information, check how that device fits your Cyber Essentials scope. Ownership alone does not settle the question. Start with how the device is used, then agree the controls and responsibilities with your IT provider and assessor.

On this page

## Work use is the starting point

[IASME’s scope guidance](https://iasme.co.uk/articles/scope) includes personal devices used to access organisational data and services, including work email. Its [contractor guidance](https://iasme.co.uk/articles/the-cyber-essentials-guide-to-working-with-contractors/) also explains why people outside the payroll can matter to the assessment.

For each device, describe the actual work it performs. A phone used for email, a contractor’s laptop accessing a shared drive and an organisation-owned computer at home may need different management arrangements. Ask the assessor about specific exceptions instead of applying a blanket rule.

## Build a small device-use list

You can start with a spreadsheet containing:

| Record | Example of useful information |
| --- | --- |
| Work activity | Email, documents or access to a business application |
| Device owner | The organisation, a staff member or a contractor |
| Device type | Phone, tablet or laptop |
| Support | Who checks the operating system and applications? |
| Access | Who grants and removes work access? |
| Open question | Anything the provider or assessor needs to clarify |

Record only what is needed for the business review. Avoid gathering private photos, messages or personal account passwords.

## Agree a workable approach with staff

Explain why the organisation needs to protect work information and what any proposed management will do. Staff should understand which business data or settings can be controlled and what happens when they leave.

Our practical recommendation is to write the agreement in everyday language. Include who supplies support, what happens if a device is lost and who to contact before replacing it. Check the technical behaviour of any management tool before describing it to staff.

Where a personal device cannot be managed appropriately, discuss another way to provide work access, such as an organisation-managed device. Confirm the resulting scope and controls with the assessor.

## Where Intune can help

Device and application management may help implement an agreed approach. The appropriate setup depends on the platform, ownership, applications and licences. It should follow the business requirements rather than assuming the same policy suits every device.

Cloud365 can scope [Intune setup](https://cloud365.io/intune-setup/) and explain proposed changes before they are applied. Buying or enabling a tool does not, by itself, establish that every Cyber Essentials requirement has been met.

## Check changes before renewal

A useful recurring question is: “Who has started using a different device for work?” Include new starters, contractors and replacement phones. Keep access-removal tasks connected to the device record when someone leaves.

Use the [current Cyber Essentials resources](https://iasme.co.uk/cyber-essentials/cyber-essentials/help-resources/) and our [requirements checklist](https://cloud365.io/blog/cyber-essentials-requirements/) to guide the wider review. If your certificate is approaching expiry, follow the [renewal checklist](https://cloud365.io/blog/cyber-essentials-renewal-checklist/).

## Ask us to help clarify the next step

Tell us roughly how many people use personal devices, which kinds of devices are involved and whether you have a certificate or customer deadline. A short description is enough for an initial discussion. Leave device identifiers and sensitive documents out of the public form.

[Ask about personal devices and Cyber Essentials](https://cloud365.io/start/?service=ce). We will confirm the preparation work or device-management project needed before quoting.

## Common questions

Are personal devices automatically outside Cyber Essentials scope?

No. Check what work information and services they access, then confirm the applicable scope and controls with your assessor.

Does using Intune guarantee certification?

No. Intune can support an agreed management approach, but certification depends on meeting the applicable requirements across the assessment scope.

## More guides

[4 November 2026 3 minute read

### Cyber Essentials Renewal: When to Start and What to Check

Plan your Cyber Essentials renewal with a practical checklist for certificates, devices, cloud services and changes since last year. Know what to prepare.

Read the guide](https://cloud365.io/blog/cyber-essentials-renewal-checklist/)[4 November 2026 3 minute read

### Cyber Essentials Plus: How to Prepare for Your Assessment

Get ready for Cyber Essentials Plus with a practical checklist for scope, devices, access and fixes. Understand what to agree before booking the assessment.

Read the guide](https://cloud365.io/blog/cyber-essentials-plus-preparation-checklist/)[22 October 2026 4 minute read

### Cyber Essentials Cost: Assessment or Supported Package?

Compare Cyber Essentials assessment fees with supported packages. See what Cloud365 includes, what fixes cost extra and how to budget for Plus and renewal.

Read the guide](https://cloud365.io/blog/cyber-essentials-cost/)