Secure your team’s work phones in 15 minutes each.
Phones carry email, chats, files and the authenticator app. Six checks close the gaps, and they line up with what Cyber Essentials asks for.
Your team’s phones probably hold more of your business than their laptops do: email, Teams or WhatsApp chats, shared files, the authenticator app, sometimes the banking app too. Learning how to secure work mobile phones takes about 15 minutes a handset, and most of it is settings people already have.
These six checks line up with what Cyber Essentials asks for on phones, so they’re worth doing before an assessment as well. Go through them with each person, or send them the list.
1. A proper screen lock
Every phone that opens work email or files needs a lock before anyone can use it: a fingerprint or face unlock, backed by a PIN or password. Cyber Essentials asks for at least 6 characters when the code only unlocks the device, so the old 4-digit PIN won’t do. Set the screen to lock itself after a minute or two of no use.
2. Limit wrong guesses
A lock only helps if someone can’t sit there guessing. Cyber Essentials wants devices to lock after no more than 10 wrong attempts, or to slow guessing down so it’s no more than 10 tries in 5 minutes. iPhones and most Android phones do this by default; just make sure nobody has switched it off. On an iPhone, “Erase Data” after 10 failed attempts is an option worth knowing about, as long as the phone is backed up.
3. Still getting updates, and installing them
Check Settings for a software update and install it. Then check the phone is still supported: once a manufacturer stops releasing security updates for a model, it can’t be used for work under Cyber Essentials. Turn on automatic updates for the phone and its apps, because critical and high-risk fixes need to be installed within 14 days.
4. Apps from the official store only
Apps should come from the App Store or Google Play, nowhere else. On Android, check that installing from unknown sources is switched off. While you’re there, delete work apps nobody uses any more, and anything that looks unfamiliar.
5. Find, lock and wipe
Turn on Find My on iPhone, or Find My Device on Android, and make sure the person knows how to use it from a laptop. If a phone goes missing, you want to lock it or wipe it within the hour, not after a weekend of hoping it turns up. Agree who they tell first, and add it to your leavers checklist so work data comes off phones when people go.
6. Personal phones count too
If someone reads work email on their own phone, Cyber Essentials treats that phone as in scope, so steps 1 to 5 apply to it as well. Phones used only for calls, texts and an authenticator app are out of scope. If you have Microsoft 365 Business Premium, app protection rules can make the Outlook and Teams apps ask for their own PIN and stop work data being copied into personal apps. That’s a lighter touch than managing the whole phone.
Keep a list
Write down which phones access work data, who has them and what software they run. You’ll need that list for Cyber Essentials anyway, and it’s the first thing you’ll want if one goes missing.
FAQ
Do I need mobile device management software?
Not to start with. A handful of phones can be checked by hand using the steps above. Once you have more phones than you can easily check, device management (such as Microsoft Intune) lets you set these rules once and see which phones meet them.
Is Face ID or a fingerprint enough on its own?
Biometrics are fine for everyday unlocking, but the phone still needs a PIN or password behind them. Make that the 6-character one.
What about tablets?
The same checks apply to tablets that access work email or files.
Source
More on this. See every guide and story on these topics, or follow Ashley on LinkedIn for a short post most days.
Ashley Adkins
Ashley runs fromIT, helping businesses across the UK respond to cyber incidents and get certified to Cyber Essentials and ISO 27001. More about Ashley.