The two models
Most small businesses end up with a mix of two approaches.
Company-owned devices are bought, set up and controlled by the business and given to staff. The business decides what is installed and can usually wipe or recover them.
Bring your own device (BYOD) means staff use their personal phones, tablets or laptops for work, for instance to read email or open shared files. It saves money and is convenient, but the business is putting its data on equipment it does not own.
Many organizations use company laptops for most staff and allow personal phones for email and messaging. The right mix depends on how sensitive your data is, your budget and how much control you need. What matters is that the rules are decided deliberately rather than by accident.
Why a policy helps
Without a written policy, nobody is sure what is allowed. Staff may save customer files to personal cloud accounts, use an old phone with no screen lock, or keep work email on a device a family member also uses. When that person leaves, or the device is lost, the business has no clear way to respond.
A BYOD policy is the agreed answer to a few questions:
- Which personal devices and uses are allowed?
- What security standards must they meet?
- What can the business see or control on them?
- What happens if the device is lost or the person leaves?
A page or two is plenty. Plain language beats legal phrasing, since the aim is that people read and follow it.
What to include
Scope
State which devices are covered (phones, tablets, laptops) and which business data or apps may be accessed from them. You might allow email and calendars on personal phones but require company laptops for customer databases or financial systems.
Minimum security standards
Set a short list that every device used for work must meet:
- A screen lock with a PIN, password or biometric.
- Automatic screen lock after a short idle period.
- The operating system and apps kept up to date; software updates should be installed promptly, and devices that no longer receive updates should not be used for work.
- Device encryption turned on where available.
- Reputable security software where relevant to the platform.
- No work data on devices with modified or “jailbroken” operating systems.
- Apps installed only from official sources, with attention to app permissions.
Add account rules too. Work logins should be protected by two-factor authentication, and staff should avoid reusing work passwords elsewhere. The business’s password policy should apply on personal devices as much as on company ones.
Keeping work and personal data apart
Where possible, use separate work apps or work profiles so that business files do not mix with personal photos and messages. Say where work files may be saved. A rule such as “save work files only in the company’s approved storage, not in personal accounts or on the device” avoids many headaches later.
Privacy and monitoring
This is where trust matters. People understandably worry about their employer seeing their personal messages and photos. Be clear and honest about what the business can and cannot do. For example:
- The business can require a passcode and remove its own email and data from the device, but does not look at personal content.
- If you use management software that can remotely wipe a device, explain whether it wipes the whole device or only business data, and when it would be used.
Rules about employee monitoring and personal data differ by country and region, so if you plan to install management tools on personal devices, it is wise to check the requirements with a qualified adviser.
Lost or stolen devices
Tell staff to report a lost or stolen device immediately, whom to call, and what the business will do, such as signing out sessions, changing passwords and wiping business data where it can. Faster reporting means less risk, so state clearly that reporting promptly will not lead to blame.
Support and costs
Decide what help the business will provide for personal devices and who pays for what. Will you contribute to phone costs? Will your support person fix a personal laptop? Defaults like “we support access to company apps, but not the device itself” keep expectations realistic.
When someone leaves
State that business data and accounts will be removed from personal devices at the end of employment, and that the person should return any company-owned equipment. This ties directly into staff offboarding, which is easier when the rules were agreed from the beginning.
Managing company-owned devices
For devices you supply, a few practices keep life simple:
- Keep an inventory with the user, model, purchase date and serial number.
- Set up each device from a standard checklist: accounts, encryption, updates, protection software and screen lock.
- Give staff standard user accounts rather than administrator rights, so malware and accidental changes have less power.
- Record how to recover or reset devices, and keep recovery keys somewhere safe that is separate from the device.
- Plan replacement when equipment becomes too old to be updated.
- Collect and wipe devices before reassigning or disposing of them.
Tools, when you need them
For a team of a few people, written rules and good habits may be enough. As you grow, mobile device management tools can help enforce settings, push updates and wipe lost devices. These tools can add cost and complexity, so introduce them when the risk justifies it.
Make it stick
- Explain the reasons. Staff are more likely to follow rules they understand.
- Have each person read and acknowledge the policy when they join.
- Review it yearly, as devices and apps change.
- Remember that remote work, where people use home networks and personal equipment, makes these rules more relevant, not less.
A good policy balances protection of the business with respect for staff privacy. If either side feels the rules are unreasonable, they tend to be worked around.