Firms in the trades often sail through the office part of Cyber Essentials and then trip over the same thing: the tablets out on site. The laptops back at base are tidy and managed. The device the site manager uses to sign off deliveries, shared between whoever is on shift, propped in a van and never really owned by anyone, is where the assessment finds its problems. Sampling exists precisely to catch the device you hoped would not come up.

Three weaknesses cluster on these devices. They tend to run on a shared login, so no one can say who used them or lock one person out. They are frequently not encrypted, which means a tablet left in an unlocked van is an open filing cabinet if it is taken. And they sit outside whatever manages the office machines, so updates, passcodes and settings are whatever the last person left them as.

The reason this matters is not box-ticking. A site tablet holds real things - client details, delivery records, photos of the job, sometimes access to email. Lost or stolen, and unencrypted, it hands all of that to whoever picks it up. Certification is simply forcing a question worth answering anyway: if that tablet vanished from a yard tonight, what walks out with it?

The fixes are the same three controls the office already has, extended to the field. Give each person their own login even on a shared device where the platform allows it, or at least a proper passcode and named accounts. Turn on the built-in encryption, which on modern tablets is often a single setting. And bring the device into the same management as the laptops so updates and passcodes are enforced, not hoped for.

Do this before the assessor samples rather than after they flag it. Sorting the site devices in advance turns a likely fail into a non-event, and it protects the data whether or not anyone ever audits you. The yards are where certification stalls only because they are where the real work, and the real risk, actually lives.