Cyber Essentials BYOD in 2026: what the April changes mean for personal devices

On 27 April 2026, Cyber Essentials changed. A new question set came into force, and several issues that used to count as major non-compliances became automatic fails. The rules on which personal devices are in scope did not change. But the consequences of getting them wrong did. 

For organisations that allow BYOD, that matters more than it might first appear. A personal phone that missed a critical update, or a cloud service reached from that phone without multi-factor authentication, can now stop you passing. This article explains the Cyber Essentials BYOD rules after the April 2026 update, why the changes hit personal devices hardest and how to keep those devices compliant using Microsoft Intune. 

Key takeaways 

• Since April 2026, missing the 14 day window for critical and high risk updates is an automatic failure rather than a major non-compliance. 
• Not enabling multi-factor authentication on a cloud service that offers it is now an automatic failure too. 
• The BYOD scope rules are unchanged: personal devices that access organisational data or services are in scope. 
• Personal devices are where those new automatic fails are hardest to control, because IT does not own them. 
• Intune compliance policies only apply to enrolled devices, so personal phones are usually protected with app protection and Conditional Access instead.

What changed in April 2026 

The NCSC published version 3.3 of the Cyber Essentials requirements in April 2026, and IASME’s new Danzell question set came into force on 27 April. The main changes were:

None of these changes are aimed at BYOD specifically. They simply raise the bar, and personal devices are usually the hardest part of the estate to keep above it. 

Cyber Essentials BYOD rules: what is in scope? 

The scope rules for personal devices are the same as before. User-owned devices that access organisational data or services are in scope, including home and remote working devices used for your organisation’s business. Here is how that works in practice. 

Why the April changes hit personal devices hardest 

Patching devices you do not own 

On company devices, IT can push updates and report on them. On personal devices, IT cannot install anything. If a member of staff ignores an iOS update for three weeks while Outlook is signed in, that device is now an automatic failure waiting to happen. The only reliable answer is to refuse access until the device is updated. 

Multi-factor authentication everywhere 

Staff often reach cloud services from their phones, and not just Microsoft 365. Every cloud service that holds or processes your data is in scope and must use multi-factor authentication where it is available. A forgotten business app accessed from a personal phone without MFA is now a much bigger problem than it used to be. 

Less room to descope 

Stricter scoping rules mean fewer ways to leave devices out of the assessment. If personal devices are reaching company data, assume they are in scope and plan accordingly. 

Quiet exceptions 

Many organisations relax controls for directors or partners who find them inconvenient. Under the new rules, an exception that lets a senior leader’s out of date phone keep accessing email is no longer a minor issue. It is a potential failure, on the device most likely to hold sensitive information. If exceptions are needed, record them, review them and consider a company-owned device instead. 

Devices you did not know about 

Microsoft 365 lets personal devices sign in by default, so many organisations have more BYOD than they realise. You cannot keep a device compliant if you do not know it exists. Registered devices and sign-in logs in Microsoft Entra ID are the place to start looking. They provide clues to investigate rather than a complete inventory, so treat them as the beginning of discovery, not the end. Our endpoint visibility and insight service is designed to give you exactly that picture. 

What Cyber Essentials expects from a personal device

How to keep personal devices compliant with Intune 

Know what compliance policies can and cannot do 

An Intune compliance policy defines what a compliant device looks like: a minimum operating system version, a PIN or password, encryption and no jailbreak or root. The important point for BYOD is that compliance policies only apply to devices enrolled in Intune, which in most organisations means company-owned devices. A personal phone that is not enrolled never receives a compliance policy, so it is never marked compliant. 

That can work in your favour. If Conditional Access requires a compliant device, an unenrolled personal device simply fails the check and is blocked, which is exactly what you want where there is no business case for BYOD. For enrolled devices, Intune can notify users and mark devices non-compliant as soon as a check fails. At Virtual Engine, for example, notifications go out immediately, and checks such as the operating system version mark a device non-compliant straight away. 

Use app protection for personal phones 

Many staff will not accept full enrolment of their own phone. For those devices, app protection policies are the main control. Conditional launch settings inside work apps can block access from out of date operating systems or jailbroken devices, while leaving the rest of the phone alone. Some Cyber Essentials requirements apply to the device itself, so deciding how far to go with each group of users is one of the most important design decisions in any BYOD project. 

Limit BYOD to the platforms that need it 

Phones and tablets are generally easier to control than personal laptops, which bring more settings, more ways to sign in and harder questions around malware protection. If nobody genuinely needs BYOD on personal computers, blocking it is the simplest route to compliance. 

Controls also need looking after between assessments. Our endpoint management service keeps compliance and app protection policies current as new operating system versions arrive. 

BYOD and GDPR 

BYOD compliance is not only about certification. Under UK GDPR, your organisation must protect personal data wherever it is accessed, including on staff devices. From a BYOD GDPR point of view, ask which personal data staff can reach from their own devices, whether you could remove it if a device was lost and whether access is limited to people who genuinely need it. Managing only company data through app protection, and being clear about what IT cannot see, helps you meet those obligations without collecting more than you need. 

Your BYOD evidence checklist 

Assessors, insurers and clients want proof rather than promises. Before your next renewal, have these ready: 

• A current count of personal devices in scope, by platform and operating system version 
• Compliance policy settings for enrolled devices and app protection settings for personal devices 
• The Conditional Access policies that block non-compliant or unprotected devices 
• A list of every cloud service in scope and confirmation that MFA is enabled on each 
• Recent compliance reports for enrolled devices and app protection reports for personal devices, showing how failures are handled 
• Your BYOD policy, user acceptance records and a register of approved exceptions 

Virtual Engine is Cyber Essentials certified itself, so we understand what assessors look for. You can find out more about our team and approach, and BYOD and mobile governance sits within our endpoint security and compliance service. 

A Cyber Essentials BYOD roadmap 

Virtual Engine’s approach to endpoint control follows three stages. Here is how they apply to personal devices under the new rules. For the detailed, step by step version, see our BYOD Control Framework. 

1. Take control. Find out which personal devices are connecting and decide whether BYOD is genuinely needed. If there is no business justification, blocking it is the most secure and simplest route to compliance. Where it is needed, decide which users and platforms are allowed, write the Cyber Essentials requirements into your compliance and app protection policies and record each design decision so it can be signed off. 

1. Stay in control. Enforce compliance through Conditional Access, review exceptions regularly and update policies as new operating system versions arrive, so every compliance device check reflects the current standard. 

1. Prove control. Use Intune compliance reports for enrolled devices, app protection reports and sign-in data for personal devices, and your MFA records as evidence for assessors, insurers and client security questionnaires. 

Get your personal devices ready for your next assessment 

If your Cyber Essentials renewal is coming up, or you are not sure how many personal devices are in scope, now is the time to check. Virtual Engine can help you find the devices, close the gaps and build the evidence you need under the new rules. Explore The BYOD Control Framework to see how to bring personal devices under control and keep them compliant.