Cyber Essentials Minimum Android and iOS Versions: How to Check if Mobiles Are Supported
Published 3 November 2026
Why there is no single minimum version
The NCSC requirements are written around support, not version numbers: software in scope must be licensed and supported, and unsupported software must be removed or isolated. Which versions are supported changes over time as vendors release new versions and stop patching old ones. Any article that gives a permanent "minimum version" will be out of date within months, so check the current position each time you assess.
Android: version and manufacturer both matter
Google publishes monthly Android security bulletins, but the patches reach a phone through its manufacturer (Samsung, Google Pixel, Motorola and others). Each manufacturer sets its own support period per model. Two phones running the same Android version can have different support status.
- Check the manufacturer's published security update policy for the specific model.
- Check the Android security patch level date in the phone's settings. If it is several months old and no newer update is offered, the device has probably left support.
- Budget phones and older models often stop receiving updates sooner than flagship devices.
iOS and iPadOS
Apple controls updates for all its devices. Apple's security releases page lists which updates fixed which issues and for which versions. The installed iOS or iPadOS version must still be receiving Apple security support and the relevant fixes; it does not automatically have to be the single latest major release. A device that can no longer receive those fixes should be treated as unsupported. Apple does not publish fixed end-of-support dates in advance, so check the current releases rather than relying on an old list.
How to check a device now
- Record make, model and operating system version for every in-scope phone and tablet.
- On each device, check whether a newer system update is available, and install it.
- For Android, note the security patch level date.
- Compare against the vendor's current support information (Apple security releases, the Android security bulletin and the manufacturer's model support policy).
- Flag devices that are no longer supported and plan to replace them before you submit.
A mobile device management (MDM) tool can report operating system versions and patch levels across the estate, which is much easier than checking phones one by one.
BYOD phones and tablets
Personally owned phones and tablets that access organisational data or services, such as work email or Teams, are in scope and must meet the same support and update rules. Staff often keep older phones longer than company-issued ones, so these are a common gap. See Cyber Essentials and BYOD.
MFA-only devices
NCSC v3.3 sets out that a device used only for multi-factor authentication, for example a personal phone used solely to approve sign-ins in an authenticator app, can be out of scope where the requirements say so. That changes as soon as the phone is also used for work email, chat, files or other organisational services: at that point it is a device accessing organisational data and is in scope.
| Phone use | Typical scope position |
|---|---|
| Authenticator app only, no work apps | Can be out of scope as an MFA-only device |
| Authenticator plus work email or Teams | In scope |
| Company-issued work phone | In scope |
What about Cyber Essentials Plus?
Mobiles can be included in the CE Plus sample, and the assessor will check that they are up to date. See BYOD testing in CE Plus.