Employees often use personal devices for work before a business sets clear rules. They may add work email to a phone. They may download a file to a home laptop. They may also sign in to a company app from a shared computer.
This can put company data at risk. Once data is on a personal device, the business has less control. It may not control updates, apps, backups, or who uses the device. It may also be hard to remove company data if the device is lost or the employee leaves.
A business can allow personal devices for some work. However, it should first decide which devices, apps, and tasks are allowed. It should use company-owned devices for admin work, sensitive tasks, and jobs that store a lot of data.
What BYOD Means
Bring your own device, or BYOD, means that an employee uses a personal phone, tablet, or computer for work.
BYOD may include these tasks:
- Adding work email to a personal phone
- Signing in to Microsoft 365 or Google Workspace
- Joining online meetings
- Opening customer or company files
- Using a business messaging app
- Accessing accounting, CRM, or project tools
- Downloading documents to a personal computer
Some business data may stay in the cloud. Other data may be stored on the device. This can include messages, attachments, cached data, and downloaded files.
What a Business Cannot Fully Control
An IT team can set and check security on a company-owned device. It has less control over a personal device.
Employees may choose which apps they install. They may decide when to update the system. They may share the device with other people. They may also send files to a personal backup service.
Management tools can enforce some rules. Yet the level of control will depend on the device, its operating system, the app, and the way the device is enrolled.
Other People May Use the Device
An employee may share a home computer or tablet with a partner, child, or other family member. Separate accounts can lower the risk. Still, many families use one shared account.
The UK National Cyber Security Centre says BYOD access should not be allowed when an employee cannot follow the needed security rules. One example is a device that cannot keep work separate from other family users.
Security Updates May Be Missing
Your IT provider may not know if a personal device uses a supported operating system. It may also be hard to confirm that current security updates are installed.
An employee may delay an update because the device has little free space. An older app may stop working after an update. The employee may also restart the device less often than needed.
Business Files May Enter Personal Storage
A file from work email or cloud storage may stay in the Downloads folder. It may also be saved in a personal document folder or device backup.
A personal cloud backup service could copy the file to an account that the business does not manage. Opening the file in a personal app may create another copy outside company control.
Personal Apps May Access Work Data
Employees choose the apps on their personal devices. Some apps may be able to read files, contacts, browser activity, or data copied to the clipboard.
The business may not know which apps are present. It may also have no clear view of the data those apps can access.
Device Repairs Can Expose Data
An employee may take a broken phone or laptop to a repair shop. Work email, saved sessions, and downloaded files could still be on that device.
Your policy should tell employees who to contact before a repair. It should also explain what to do when the device will not open.
Data May Remain When an Employee Leaves
Disabling an account can stop future access to many cloud services. It does not remove every local copy.
Files may remain in personal folders, personal backups, or apps that the business does not manage. A managed work profile can make removal easier. However, it can remove only the data it controls.
Decide Which Work Is Allowed
Set access rules based on the task and the type of data involved. A personal device may be suitable for some work but not for all work.
For example, you may let staff read email through an approved mobile app. You may still require a company computer for a customer database export.
People who handle financial records, health information, legal files, or large sets of customer data may need company-owned devices. These devices give the business more control over storage and security.
Admin work should take place on a managed device. This rule should apply to anyone who manages user accounts, security settings, backups, or business systems.
Use the same approach for contractors. Give them access only to the apps and data they need for their work.
Set Security Rules for Personal Devices
A personal device should meet your security rules before it can access company data. The rules should be clear and easy to check.
Use a Supported Operating System
The device should use an operating system that still gets security updates. Block devices that can no longer install current updates.
Install Updates on Time
Turn on automatic updates for the operating system and apps when possible. Employees should restart their devices when an update needs a restart.
Require a Screen Lock
Require a PIN, password, fingerprint, or face scan to unlock the device. The screen should lock on its own when the device is not in use.
Require Device Encryption
Encryption helps protect stored data if a device is lost or stolen. The Australian Cyber Security Centre recommends full-device encryption when a personal device may store business data.
Encryption must be turned on before the device goes missing. It should also be backed by a strong password or PIN.
Require MFA
Require multi-factor authentication, or MFA, for work email, cloud storage, and other key systems. The UK National Cyber Security Centre recommends MFA as a minimum rule for BYOD access.
MFA helps protect account sign-ins. It does not protect every file after a user downloads it. Use encryption and managed apps to help protect stored data.
Block Rooted or Jailbroken Devices
Rooting or jailbreaking removes some built-in security limits. Do not allow these devices to access company data.
Tools may not detect every rooted or jailbroken device. Use this check with the other controls in your policy.
Approve Apps Used for Work
Tell employees which apps they may use for email, messages, files, and other work. Do not leave this choice open.
Where possible, stop company data from being saved to personal storage. You can also block users from copying work data into apps that the business does not manage.
Separate Users on Shared Computers
An employee who uses a personal computer for work should have a separate user account. Other people should use their own accounts. They should not know the employee’s password.
Do not allow BYOD access if the employee cannot keep work separate from other people who use the device.
Make Problem Reporting Simple
Employees should know who to contact if a device is lost, stolen, repaired, replaced, or infected with malware.
Fast reports give the business more time to disable access. The IT team can also check account activity and remove managed data.
Use Managed Apps or Work Profiles
Device and app management services can help keep work data separate from personal data.
Mobile device management, or MDM, can apply settings to an enrolled device. It can also report whether the device meets company rules. The amount of control depends on the platform and the way the device is enrolled.
Mobile application management, or MAM, controls supported work apps and their data. It may block copying, stop files from being saved to personal storage, require another PIN, or remove company data from managed apps.
For example, Microsoft Intune can remove company data from protected apps if a device is lost or an employee leaves. Personal data can stay on the device.
Selective removal has limits. It affects only data managed by the service. It cannot delete a file that was copied to a personal backup, an unsupported storage area, or an unmanaged app.
A factory reset removes both personal and company data. Microsoft warns about this risk when full device management is used on devices the business does not own.
Use selective removal where possible. Tell employees what the management service can see, control, and remove.
What a BYOD Policy Should Cover
A written policy should answer clear questions before employees add company access to their devices.
- Which employees and contractors may use personal devices?
- Which types of devices are allowed?
- Which work tasks may be done on them?
- Which apps must employees use?
- May users download company files?
- May other people share the device?
- Which security settings are required?
- What data can the business or IT provider see?
- Which settings can the business control?
- Can the business remove company data from the device?
- What happens if the device is lost or stolen?
- What must happen before the device is repaired or sold?
- What happens when an employee leaves?
- Who pays for data, repairs, or a replacement?
Privacy, employment, and data protection rules differ by country. Have the policy reviewed for each place where you employ people.
Employees should read and accept the policy before company access is added to a personal device.
What to Do When a Device Is Lost or Stolen
The employee should contact the business or IT provider at once. The response may depend on the device, the apps, and the data stored on it.
Your response may include these steps:
- Disable access if the device cannot be found
- Revoke active sign-in sessions
- Remove company data from managed apps
- Remove the device from approved-device lists
- Check account activity for unexpected sign-ins
- Reset credentials that may have been exposed
- Record which company files may be on the device
A remote lock or removal command works only after the device connects to the management service. A device that stays off or offline may never receive the command.
This is why encryption and account controls still matter. A business should not depend on remote removal alone.
What to Do When an Employee Leaves
Disable the employee’s account at the agreed time. Revoke active sessions so that old sign-ins cannot stay open.
Remove company data from managed apps and work profiles. Then check whether the employee downloaded business files to the device.
Confirm how those copies will be returned or deleted. Keep in mind that management tools can remove only the data they control.
Build a Practical BYOD Plan
Personal devices can support approved work when the business sets firm limits. Start with the task, the app, and the type of data involved.
Allow access only through approved apps and only from devices that meet your security rules. Use company-owned devices for admin work, sensitive records, and tasks that store large amounts of data.
A clear policy, strong account controls, device encryption, managed apps, and fast reporting can reduce BYOD risk. They also help employees know what is expected before a device is lost, repaired, or replaced. Need help drafting a BYOD plan? Contact our team today.
