Article Summary: A good BYOD policy allows personal devices only for approved work, through approved apps, and only when the device meets your security requirements. Use company-owned devices for administration, sensitive work, or jobs that require storing large amounts of data locally.

Employees often start using personal devices for work before the business makes any decision about it. They add work email to a phone, download a file to a home laptop, or sign into a company app from a computer they share with family.

Once business data lands on a personal device, you have less control over updates, installed apps, backups, and who else uses it. You also need a way to remove company data when the employee leaves or loses the device.

Personal devices can work, but the business should decide which devices, apps, and types of work it allows. At Pacific Edge Technology, we help businesses across Richland, Kennewick, and Pasco set up a BYOD policy that protects company data without overreaching into employees’ personal lives.

What BYOD includes

Bring your own device, or BYOD, means an employee uses a personally owned phone, tablet, or computer for work. That can include:

Adding work email to a personal phone
Signing into Microsoft 365 or Google Workspace
Joining online meetings
Opening customer or company files
Using a business messaging app
Accessing accounting, CRM, or project management software
Downloading documents to a personal computer

Depending on the app, business information may stay in the cloud or download to the device as messages, attachments, cached data, or files.

What you can’t fully control on a personal device

Your IT team can set and monitor security on company-owned devices. With personal devices, employees decide which apps to install, when to update, who else uses the device, and where files get backed up.

Employee using a personal phone and laptop for work under a BYOD policy

Management software can enforce some rules. The available controls depend on the device, operating system, app, and enrollment method.

Other people may use the device

An employee may share a home computer or tablet with a partner, child, or other family member. Separate user accounts reduce the risk, but many families share one account on a single device.

The UK’s National Cyber Security Centre says businesses shouldn’t allow BYOD access when an employee can’t follow the required security rules. One of its examples is a device that can’t keep the employee’s work separate from other family members. (NCSC BYOD guidance)

Updates may be missing

Your IT provider may not be able to confirm whether a personal device runs a supported operating system or has current security updates. Employees often delay updates because the device is low on storage, an older app might break, or they rarely restart.

Business files may end up in personal storage

A file downloaded from work email or cloud storage may sit in the Downloads folder, a personal folder, or a device backup. A personal cloud backup service could then copy it to an account the business doesn’t manage. Opening the file in a personal app may create yet another unmanaged copy.

Other apps may access business information

Employees choose the apps on their personal devices. Some of those apps may have permission to read files, contacts, browser activity, or anything copied to the clipboard. The business usually has no idea which apps the employee installed or what they can reach.

Repairs can expose business data

An employee may take a broken personal phone or laptop to any repair shop they choose. Business email, saved logins, or downloaded files could still be on the device. Your BYOD policy should tell employees who to contact before a repair, and what to do if the device won’t turn on.

Company data may remain after someone leaves

Disabling an employee’s account stops future access to many cloud services. It doesn’t remove copies they downloaded to personal folders, opened in unmanaged apps, or saved to personal storage.

Managed work profiles and protected apps make removing company data easier. But they can only remove the information they control.

Decide what work is allowed

Base access on the work involved and the information it touches.

For example, you might allow employees to read work email through an approved mobile app, but require a company computer for exporting customer data. Staff who handle financial records, health information, legal documents, or large amounts of customer data may also need company-owned devices.

Administrative work should always happen on a managed device. Anyone who manages user accounts, security settings, backups, or business systems shouldn’t do that work from an unmanaged personal computer.

Apply the same rules to contractors. Limit their access to the apps and information their work requires.

Security requirements for personal devices

A personal device should meet your requirements before it can reach company information.

Securing a personal device with a screen lock and encryption before accessing company data

Use a supported operating system

The device should run an operating system that still gets security updates. Block access from devices that can’t install current updates.

Install security updates

Turn on automatic updates for the operating system and apps wherever possible. Employees should restart their devices when an update requires it.

Require a screen lock

Require a PIN, password, fingerprint, or face scan to unlock the device. Set the screen to lock automatically when nobody is using it.

Require device encryption

Encryption protects stored information if someone loses a device or a thief takes it. The Australian Cyber Security Centre recommends full-device encryption whenever personal devices may store business information.

Encryption only helps if it’s turned on before the device goes missing. It also needs a strong password or PIN behind it.

Require MFA

Require MFA for work email, cloud storage, and other important systems. The NCSC recommends MFA as a minimum for BYOD access. MFA protects account sign-ins, while encryption and managed apps protect information already on the device.

Block rooted or jailbroken devices

Rooting or jailbreaking removes some of a device’s built-in security restrictions. Don’t let these devices access company data. Detection isn’t perfect, so use it alongside the other controls in this article.

Approve the apps used for work

Tell employees which apps they may use for email, messaging, file access, and other work. Where your management tools support it, block employees from saving business information to personal storage or copying it into unmanaged apps.

Use separate accounts on shared computers

A personal computer used for work should have its own account for the employee. Other users should have separate accounts and shouldn’t know the employee’s password. If the employee can’t keep work separate from other users, don’t allow BYOD access on that device.

Tell employees how to report problems

Employees need to know who to contact if a device is lost, stolen, repaired, replaced, or infected with malware. Early reporting gives you more time to cut off access, check account activity, and remove managed data.

Control business data with managed apps or work profiles

Device and app management tools can help keep work information separate from personal information.

Mobile device management (MDM) applies settings to an enrolled device and reports whether it meets company requirements. The level of control depends on the platform and enrollment method.

Mobile application management (MAM) applies controls to supported work apps and their data. Depending on the product, it can restrict copying, block saving to personal storage, require an extra PIN, or remove company information from managed apps.

For example, Microsoft Intune can remove company data from protected apps when someone loses a device or leaves the company. The employee’s personal information stays on the device.

Selective removal only affects data the service manages. It can’t delete a file someone copied into an unmanaged app, a personal backup, or an unsupported storage location.

Avoid full wipes on personal devices

A factory reset erases personal and business data alike. Microsoft warns administrators about applying full device management to computers and phones the business doesn’t own. Use selective removal where possible, and tell employees exactly what your management tools can see and do. (Microsoft Intune planning guide)

What your BYOD policy should cover

Your BYOD policy should answer these questions:

Which employees and contractors may use personal devices?
Which types of devices does it allow?
What work can they do on those devices?
Which apps must they use?
Can they download company files?
Can they share the device with other people?
Which security settings must the device have?
What information can the business or IT provider see?
What settings can the business control?
Can the business remove company information remotely?
What happens if the device is lost or stolen?
What must happen before the device is repaired or sold?
What happens when the employee leaves?
Who pays for mobile data, repairs, or replacement?

Privacy and employment rules vary by state, and some industries have extra data protection requirements. Have an attorney review your BYOD policy, especially if you employ people in more than one state.

Employees should read and accept the policy before you add company access to their devices.

What to do when a personal device is lost or stolen

The employee should contact the business or IT provider right away. Your response may include:

Disabling access if nobody can account for the device
Revoking active sign-in sessions
Removing company data from managed apps
Removing the device from approved-device lists
Checking account activity for unexpected sign-ins
Resetting passwords that may have been exposed
Recording which company files may have been on the device

Remote lock and removal commands only work once the device connects to the management service. A device that stays off or offline may never receive the command. That’s why encryption and account controls still matter, since remote removal might never run.

What to do when an employee leaves

Disable the employee’s account and revoke active sessions at the agreed time. Remove company data from managed apps or work profiles.

Check whether they downloaded business files to the device, and confirm how they’ll return or delete those copies.

Remove the device from your approved-device records. Where your management tools support it, also remove business apps, certificates, email profiles, and VPN settings.

When personal devices shouldn’t be allowed

Provide a company-owned device when:

The employee handles sensitive information
The role requires administrator access
The job requires storing large amounts of company data locally
Other people share the device
The operating system no longer gets updates
The device can’t support encryption
The business can’t separate or remove its data
The employee doesn’t accept the required security controls
Someone has rooted or jailbroken the device

Company-owned devices are also easier for your IT provider to support, since everyone knows their settings and installed software.

If you’re a Tri-Cities business and employees already use personal devices for work, get in touch with Pacific Edge Technology. We’ll check what those devices can access, set up the right controls, and help you put a clear BYOD policy in place.

BYOD Policy FAQs

Can employees use a web browser without enrolling their personal device?

You can allow browser access, but information may still remain in the browser cache, Downloads folder, saved passwords, screenshots, or active sessions. Access policies can limit which devices and browsers people can use. Sensitive work may still require a managed device.

Is MFA enough to secure a personal device?

No. MFA protects the employee’s account. Encryption protects stored files, and managed apps control how people use and copy company information. You still need updates, screen locks, approved apps, and a process for lost devices.

Can the business see an employee’s personal information?

It depends on the management method. App management focuses on business apps and their data. Device enrollment can show device details and allows broader control. Before employees enroll, give them a written explanation of what your IT team can see, change, lock, or remove.

Can the business erase a personal phone?

Some enrollment methods support a full factory reset, while app-only management doesn’t. A factory reset deletes personal information along with company data. Use selective removal for employee-owned devices wherever it’s available.

Is BYOD cheaper than providing company devices?

BYOD may reduce hardware purchases, but it can add costs for management, support, and security. Whether it saves money depends on the devices, apps, and work your BYOD policy allows.

Sources and further reading

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Should Employees Use Personal Devices for Work?

What BYOD includes