Does Cyber Essentials cover home and remote workers?

Yes. Anyone who works from home or another remote location, even occasionally, even one day a week, brings their device into scope if it connects to company data or services. The home router itself doesn't need to meet the standard, but the laptop or phone connecting through it does: the same firewall, secure configuration, patching, access control, and anti-malware requirements apply as they would in the office.

The most common mistake isn't deliberate: businesses assess their office-based kit thoroughly and simply forget remote workers' devices exist, or assume a personal laptop "isn't really a company device." If it touches organisational data, whose desk it usually sits on doesn't matter.

A VPN or device-management tool makes this easier to demonstrate consistently, but it's not the requirement itself: what matters is that the controls genuinely apply, wherever the device is. Run the free 5-minute readiness check to see how your remote setup measures up.