NCSC Device Security Guidance explained

What the NCSC Device Security Guidance is

The Device Security Guidance is a collection published by the National Cyber Security Centre to help organisations secure their devices. It answers three practical questions: which devices you should buy, how you should configure them, and what security software you should load onto them. The NCSC's older end user device security and mobile device guidance collections now lead to it, which is why people still search for "NCSC end user device guidance" and "NCSC mobile device guidance".

The current collection is version 2.1, first published on 29 June 2021 and reviewed on 13 May 2025. It is written mainly for organisations deploying or managing larger IT estates, but the NCSC says the advice holds good for all users and operating systems, so it is still useful if you only look after a few devices.

It is guidance, not a standard you certify against. In practice it sits underneath the frameworks you may be assessed on: following it makes Cyber Essentials and other requirements easier to meet (see endpoint security compliance).

The six parts of the guidance, mapped to controls

The collection is split into six areas. This table shows what each covers and where the matching controls are explained on this site.

Key points from each part

Getting ready Security starts at purchase. The guidance covers choosing devices and operating systems that can be configured securely and will receive updates for as long as you need them, then provisioning them centrally, with zero-touch enrolment where your platforms support it, into mobile device management, so users receive a device that is already configured.

Infrastructure Devices are only as secure as the way they connect. The guidance covers an enterprise authentication policy that balances security with usability, and the use of virtual private networks (VPNs). Modern approaches check a device's health before allowing access, which is the heart of zero trust endpoint security.

Policies and settings This is where most security software decisions sit. The NCSC's page on antivirus and other security software makes a nuanced point: the antivirus built into major operating systems will meet many organisations' needs, and where you are confident devices cannot run known malware, antivirus offers very limited value. If you do use a product, make an informed choice, keep it updated and do not run more than one antivirus product on a device, because they can conflict. The same page asks you to consider how to prevent lateral movement if a device is compromised, something EDR detection and device isolation can help with. Separate pages cover browser security, peripherals (the basis for USB device control) and third-party applications (the basis for application allowlisting).

Managing deployed devices Keep operating systems, browsers, apps and security software up to date, and replace unsupported products as soon as you can. The logging and protective monitoring page explains why host-based logs, such as process and program load events, matter for spotting attackers who move from one device to another, which is the job EDR and XDR do. The obsolete products page is candid: the only fully effective way to manage the risk is to stop using the product, and until then you should reduce both the likelihood and the impact of compromise.

Bring your own device The BYOD section sets out five actions, from deciding your objectives to putting technical controls in place, and is the starting point for our BYOD security guide.

Platform guides Each platform guide gives specific configuration advice, and the NCSC publishes its recommended configurations for these platforms in a GitHub repository. They are a practical baseline for endpoint hardening.

NCSC device security principles

People searching for "NCSC device security principles" are usually looking for one of two things.

The older end user device security principles belonged to the guidance that the Device Security Guidance replaced; the NCSC's old link for them now leads to the newer principles below. The current document is the Device security principles for manufacturers, produced by the NCSC with the Department for Science, Innovation and Technology (version 2.1, published 10 May 2022, reviewed 13 May 2025). It is aimed mainly at manufacturers of enterprise-connected devices, but the NCSC says organisations can use the principles as a framework when procuring devices, and it encourages manufacturers to publish a transparency report on how their products meet them. There are eleven principles (the NCSC notes they are not ordered by importance):

1. Provide updates, securely
2. Support appropriate authentication
3. Protect data at rest and in transit
4. Maintain device integrity
5. Ensure transparency of device health
6. Permit only trusted software
7. Minimise the privilege and reach of applications
8. Constrain the use of all device interfaces
9. Allow robust device management
10. Provide security logging, alerting and monitoring capabilities
11. Enable recovery to a known good state

For buyers, the useful question is simple: can the devices and management tools you are considering meet these principles, and will the manufacturer say how? If you manage and procure devices, the NCSC points you back to the Device Security Guidance for the day-to-day detail.

Putting the guidance into practice

Reading thirty-odd pages is one thing; applying them across a mixed estate is another. A practical order of work:

1. List your devices and platforms, including phones and any personal devices that reach organisational data.
2. Pick a baseline per platform from the NCSC platform guides and recommended configurations, and record any deliberate differences.
3. Enrol devices centrally in a management platform so the baseline is applied and drift is reported.
4. Decide your security software: built-in protection, an endpoint protection platform, EDR, or EDR with a vendor-run managed service, depending on your risk and who will act on alerts.
5. Set the policies for browsers, applications, peripherals and cloud services, starting in audit mode where the tool allows.
6. Keep it current: automate updates, monitor for unsupported versions, and plan replacements before support ends.
7. Collect the evidence: coverage, patch, encryption and configuration reports that show the guidance is being followed.

Our endpoint security best practices page turns this into a checklist, and the endpoint security policy guide shows how to write it down.

How we help

We supply several endpoint security and device management platforms, so we can help you apply the NCSC's advice with tools that fit your estate rather than the other way round. We can:

• Compare your current device set-up with the Device Security Guidance and the relevant platform guides
• Recommend and supply EDR, encryption, patching, device control and mobile threat defence where there are gaps, with pricing confirmed at quote
• Help plan enrolment, baselines and staged policy rollout
• Help set up the reports that show the guidance is being followed

Contact us to talk through applying the NCSC Device Security Guidance to your devices.