Is It Safe for Employees to Use Personal Devices for Work?

Getting your Trinity Audio player ready...

Employees often begin using personal devices for work before their company creates a formal policy. They may add work email to a smartphone, download a document to a home laptop, or access a company application from a computer shared with family members.

Once company information reaches a personal device, the business has less control over software updates, installed applications, backups, and who can access the device. The company also needs a reliable way to protect or remove its data if the device is lost, stolen, or no longer used by the employee.

Allowing personal devices for work can be convenient, but it should never happen without clear boundaries. Every business should decide which devices, applications, and work activities are permitted before granting access.

Understanding Bring Your Own Device (BYOD)

Bring your own device, commonly called BYOD, is a workplace arrangement that allows employees to use personally owned phones, tablets, or computers for business purposes.

BYOD may include:

• Adding a work email account to a personal phone
• Signing in to Microsoft 365 or Google Workspace
• Participating in virtual meetings
• Viewing customer or company documents
• Using an approved business messaging application
• Accessing accounting, CRM, or project management software
• Downloading work documents to a personal computer

Depending on the application, company information may remain in the cloud or be stored on the device as downloaded files, messages, attachments, or cached data.

Where Businesses Lose Control of Personal Devices

Your IT team can configure, secure, and monitor company-owned equipment. With a personal device, however, the employee usually decides which applications to install, when to update the operating system, who else can use the device, and where files are backed up.

Device management software can enforce certain rules, but the available protections depend on the device, operating system, application, and enrollment method.

Shared Access Can Put Company Data at Risk

An employee may share a personal computer or tablet with a spouse, child, or other family member. Separate user accounts can reduce the risk, but many households still use one shared account.

The UK National Cyber Security Centre advises businesses not to allow BYOD access when an employee cannot meet the required security standards. One example is a device that cannot keep the employee’s work separate from other family users. Read the NCSC BYOD guidance.

Devices May Fall Behind on Updates

Your IT provider may be unable to verify whether a personal device uses a supported operating system or has the latest security updates installed.

Employees sometimes postpone updates because their device has limited storage, they are concerned that an older application will stop working, or they rarely restart the device. These delays can leave known security weaknesses unpatched.

Work Documents Can End Up in Personal Storage

A document downloaded from work email or cloud storage may remain in a Downloads folder, personal documents folder, or device backup.

A personal cloud backup service could then copy the document to an account that the company does not control. Opening it with a personal application may also create another unmanaged copy.

Personal Apps Could Access Business Information

Personal devices contain applications selected by the employee. Some of these applications may have permission to access files, contacts, browser activity, or information copied to the clipboard.

The business may have no visibility into which applications are installed or what information those applications can access.

Device Repairs May Expose Sensitive Data

When a personal phone or laptop breaks, the employee may take it to a repair shop of their choice. Work email, saved login sessions, and downloaded business files could still be accessible on the device.

Your BYOD policy should explain whom employees must contact before arranging a repair and what to do when the device cannot be opened or secured.

Business Data May Remain After an Employee Leaves

Disabling a former employee’s account prevents future access to many cloud services. However, it does not remove documents previously downloaded to personal folders, opened in unmanaged applications, or copied to personal storage.

Managed work profiles and protected applications make company data easier to remove. Even so, these tools can only delete the information they manage.

Set Clear Limits on Permitted Work

Access decisions should reflect the employee’s role and the sensitivity of the information involved.

For example, you might allow employees to read work email through an approved mobile application while requiring them to use a company-owned computer when exporting customer records. Employees who handle financial information, health records, legal documents, or large amounts of customer data may also need managed company devices.

Administrative tasks should always be completed from a managed device. Employees responsible for user accounts, security settings, backups, or critical business systems should not perform that work from an unmanaged personal computer.

The same rules should apply to contractors. Their access should be limited to the applications and information they need to complete their assigned work.

Minimum Security Standards for BYOD

Before a personal device can access company information, it should meet your organization’s security requirements.

Allow Only Supported Operating Systems

The device should use an operating system that still receives security updates. Block access from outdated devices that can no longer install current patches.

Keep Devices and Applications Updated

Operating system and application updates should install automatically whenever possible. Employees should also restart their devices promptly when an update requires it.

Protect Access With an Automatic Screen Lock

Require employees to unlock their devices with a PIN, password, fingerprint, or facial recognition. The screen should also lock automatically after a short period of inactivity.

Encrypt Information Stored on the Device

Encryption helps prevent unauthorized access to stored information when a device is lost or stolen. The Australian Cyber Security Centre recommends full-device encryption when personal devices may contain business information. Review the Cyber.gov.au BYOD guidance.

Encryption must be enabled before the device goes missing. It should also be paired with a strong password or PIN.

Protect Work Accounts With MFA

Require multifactor authentication, or MFA, for work email, cloud storage, and other important systems. The NCSC recommends MFA as a minimum security measure for BYOD access.

MFA protects account sign-ins, but downloaded files still need protection through encryption and managed applications.

Deny Access From Rooted or Jailbroken Devices

Rooting or jailbreaking removes some of a device’s built-in security restrictions. Devices that have been modified this way should not be permitted to access company information.

Detection tools are not always perfect, so this requirement should be combined with the other BYOD security controls covered in this article.

Limit Work to Approved Applications

Tell employees which applications they are allowed to use for work email, messaging, file access, and other business activities.

If your management platform supports it, prevent employees from saving company information to personal storage or copying it into unmanaged applications.

Separate Work From Other Computer Users

A personal computer used for work should have a dedicated account for the employee. Other household members should use separate accounts and should not know the employee’s password.

Do not allow BYOD access when company information cannot be separated from other people who use the device.

Make Security Incident Reporting Simple

Employees should know exactly whom to contact if their device is lost, stolen, infected with malware, repaired, or replaced.

Fast reporting gives the business more time to disable access, review account activity, and remove managed company data.

Separate Company Information With Managed Apps

Device and application management services can help keep business data separate from an employee’s personal information.

Mobile device management, or MDM, can apply security settings to an enrolled device and report whether it meets company requirements. The amount of control available depends on the platform and enrollment method.

Mobile application management, or MAM, applies security controls to supported business applications and the information stored within them. Depending on the platform, MAM may restrict copying, prevent files from being saved to personal storage, require an additional PIN, or remove company information from managed applications.

For example, Microsoft Intune can remove company data from protected applications when a device is lost or an employee leaves. The employee’s personal information can remain on the device.

Selective removal only affects information controlled by the management service. It cannot delete a document copied to an unmanaged application, personal backup, or unsupported storage location.

A factory reset removes both personal and business information. Microsoft cautions administrators about using full-device management on computers and phones the company does not own. Configure selective removal whenever possible and clearly explain what your management service can see, control, and erase. Review the Microsoft Intune planning guide.

Essential Elements of a BYOD Policy

Your BYOD policy should clearly answer the following questions:

• Which employees and contractors may use personal devices?
• What types of devices are allowed?
• Which work activities can employees perform on them?
• Which approved applications must employees use?
• Can employees download company files?
• Can anyone else share or use the device?
• Which security settings are mandatory?
• What information can the business or IT provider see?
• Which device settings can the business control?
• Can company information be removed remotely?
• What happens when a device is lost or stolen?
• What must employees do before repairing or selling a device?
• What happens to company data when an employee leaves?
• Who pays for mobile data, repairs, or replacement devices?

Privacy, employment, and data protection requirements vary by country and location. Have your BYOD policy reviewed for every area where your company employs people.

Employees should read and accept the policy before work access is added to their personal devices.

How to Respond to a Lost or Stolen Device

Employees should contact the company or its IT provider as soon as they realize a personal device is missing.

Your response may include:

• Disabling access if the device cannot be located
• Revoking active sign-in sessions
• Removing company data from managed applications
• Removing the device from approved-device lists
• Reviewing account activity for unusual sign-ins
• Resetting credentials that may have been exposed
• Identifying which company files may be stored on the device

Remote locking and data-removal commands only work after the device connects to the management service. A phone or computer that remains turned off or offline may never receive the command.

Because remote removal is not guaranteed, device encryption and strong account security remain essential.

Removing BYOD Access When Employment Ends

Disable the employee’s accounts and revoke active sessions at the agreed time. Company information should also be removed from managed applications and work profiles.

Determine whether the employee downloaded business documents to the device. Confirm that those copies have been returned or permanently deleted.

Remove the device from your approved-device records. If your management platform supports it, remove business applications, security certificates, email profiles, and VPN settings as well.

Situations Where BYOD Is Not Appropriate

Provide a company-owned device when:

• The employee handles sensitive or regulated information
• The role requires administrator-level access
• Large amounts of company data must be stored locally
• The device is shared with other people
• The operating system no longer receives security updates
• Device encryption cannot be enabled
• The business cannot separate or remove its information
• The employee does not agree to the required security controls
• The device has been rooted or jailbroken

Company-owned devices are generally easier for an IT provider to secure and support because their settings, applications, and security protections are known. If your business allows employees to use personal devices for work, a clear BYOD policy and the right security controls can reduce risk while keeping access convenient.

Twintel can help your business evaluate BYOD risks, create practical device policies, and protect company information across approved devices. Contact Twintel to discuss the right approach for your organization.