Employees often use personal devices for work before the business has made a decision about it. They add work email to a phone, download a file to a home laptop, or sign into a company app from a computer shared with family.
Once business data is stored on a personal device, you have less control over updates, installed apps, backups, and who else uses the device. You also need a way to remove company data when the employee leaves or the device is lost.
Personal devices can be allowed, but the business should decide which devices, applications, and types of work are permitted.
Bring your own device, usually shortened to BYOD, means an employee uses a personally owned phone, tablet, or computer for work.
That can include adding work email to a personal phone, signing into Microsoft 365 or Google Workspace, joining online meetings, opening customer or company files, accessing accounting, CRM, or project management software or downloading documents to a personal computer.
Depending on the application, business information may remain in the cloud or be downloaded to the device as messages, attachments, cached data, or files.
What you cannot fully control on a personal device
Your IT team can set and monitor security on company-owned devices. With personal devices, employees choose which apps to install, when to update the operating system, who else uses the device, and where files are backed up.
Management software can enforce some rules, but the available controls depend on the device, operating system, application, and enrolment method.
- Other people may use the device
An employee may share a home computer or tablet with a partner, child, or another family member. Separate user accounts can reduce the risk, but many personal devices are used through one shared account.
- Updates may be missing
Your IT provider may not be able to confirm whether a personal device runs a supported operating system or has current security updates.
An employee may delay an update because the device lacks storage, an older application might stop working, or the device is rarely restarted.
- Business files may enter personal storage
A file downloaded from work email or cloud storage may remain in the Downloads folder, a personal document folder, or a device backup.
A personal cloud backup service could then copy the file to an account the business does not manage. Opening the document in a personal application may create another unmanaged copy.
- Other applications may access business information
Personal devices contain applications chosen by the employee. Some may have permission to read files, contacts, browser activity, or information copied to the clipboard.
The business may not know which applications are installed or what those applications can access.
- Repairs can expose business data
A broken personal phone or laptop may be taken to a repair shop chosen by the employee. Business email, saved sessions, or downloaded files could still be available on the device.
Your policy should tell employees who to contact before a device is repaired and what to do if the device cannot be opened.
- Company data may remain after employment ends
Disabling an employee’s account stops future access to many cloud services. It does not remove copies that were downloaded to personal folders, opened in unmanaged applications, or copied to personal storage.
Managed work profiles and protected applications make it easier to remove company data. They can only remove the information they control.
Decide what work is allowed
Set access based on the work being performed and the information involved.
You might allow employees to read work email through an approved mobile app while requiring a company computer for customer database exports. Staff handling financial records, health information, legal documents, or large amounts of customer data may also need company-owned devices.
Administrative work should be performed from a managed device. Anyone responsible for user accounts, security settings, backups, or business systems should not do that work from an unmanaged personal computer.
Apply the same rules to contractors. Their access should be limited to the applications and information required for their work.
Security requirements for personal devices
A personal device should meet your requirements before it can access company information.
-
Use a supported operating system - The device should run an operating system that still receives security updates. Block access from devices that can no longer install current updates.
- Install security updates - Operating system and application updates should install automatically where possible. Employees should restart their devices when an update requires it.
- Require a screen lock - Require a PIN, password, fingerprint, or facial recognition to unlock the device. Configure the screen to lock automatically when the device is not being used.
- Require device encryption - Encryption helps protect stored information if a device is lost or stolen. It also needs to be supported by a strong device password or PIN.
- Require MFA - Require MFA for work email, cloud storage, and other important systems. Use MFA for account sign-ins. Protect downloaded information with encryption and managed applications.
- Approve the applications used for work - Tell employees which applications they may use for email, messaging, file access, and other work. Where your management service supports it, prevent business information from being saved to personal storage or copied into unmanaged applications.
- Use separate accounts on shared computers - A personal computer used for work should have a separate account for the employee. Other users should have their own accounts and should not know the employee’s password. Do not allow BYOD access when work cannot be kept separate from other users of the device.
- Tell employees how to report problems - Employees need to know who to contact if a device is lost, stolen, repaired, replaced, or infected with malware. Early reporting gives the business more time to disable access, check account activity, and remove managed data.
Control business data with managed apps or work profiles
Device and application management services can help keep work information separate from personal information.
Mobile device management, or MDM, can apply settings to an enrolled device and report whether it meets company requirements. The amount of control depends on the platform and enrollment method.
BYOD Policy
Employees should read and accept a BYOD policy before company access is added to their devices.
The policy should cover questions such as
- Which employees and contractors may use personal devices?
- Which types of devices are permitted?
- What work can be performed on them?
- Which applications must be used?
- Can company files be downloaded?
- Can the device be shared with other people?
- Which security settings are required?
- What happens if the device is lost or stolen?
- What must happen before the device is repaired or sold?
- What happens when the employee leaves?
- Who pays for mobile data, repairs, or replacement?
When personal devices should not be allowed
Provide a company-owned device when:
- The employee handles sensitive information
- The role requires administrator access
- Large amounts of company data must be stored locally
- The device is shared with other people
- The operating system is no longer supported
- Encryption cannot be enabled
- The business cannot separate or remove its data
- The employee does not accept the required security controls
- The device has been rooted or jailbroken
Company-owned devices are easier for your IT provider to support because their settings and installed software are known.
If employees already use personal devices for work, ask your IT provider to check what they can access and whether the required controls are in place.
And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it out.
