To secure personal devices on a remote team, set minimum device requirements, require strong sign-in with MFA, keep company data inside protected work apps or the browser, and make sure you can remove company data when someone leaves, without touching their personal data.
BYOD is already happening
On a remote team, personal devices are everywhere. People check email on their own phones, join calls from a family laptop, and open shared files on a tablet. Contractors almost always use their own equipment. Banning it outright rarely works, and pushes the activity somewhere you can’t see.
The real risks are specific:
- Lost or stolen devices with email and files synced locally.
- Outdated, unpatched devices that are easy to compromise.
- Shared family devices where others can reach work accounts.
- Data leaking into personal apps, like a client file saved to personal cloud storage.
- Former employees who still have company data on their own phone.
Three ways to secure personal devices
| Approach | What it does | Best for | Trade-off |
|---|---|---|---|
| Full device management | Enrolls the whole device; the company can enforce settings and wipe it | Company-owned devices | Employees often won’t accept it on personal devices |
| App protection | Protects only work apps and their data; personal apps untouched | Personal phones and tablets | Needs apps that support it |
| Browser-only access | Work happens in a protected browser session; little or no data stored on the device | Contractors, occasional access, very sensitive data | Less convenient for daily heavy use |
Most remote teams use a mix: full management on company laptops, app protection on personal phones, and browser-only access for contractors.
App protection, in plain English
App protection (sometimes called mobile application management) puts rules on the work apps themselves rather than the device. Copy and paste from work email into a personal app can be blocked, files can be saved only to approved company storage, and the work apps can require a PIN. When someone leaves, a selective wipe removes the company data from those apps and nothing else.
Minimum requirements for any device that touches company data
Whatever approach you choose, set a baseline and enforce it at sign-in:
- Supported operating system that still receives security updates.
- Screen lock with a PIN, password or biometric.
- Encryption turned on (standard on modern phones; check laptops).
- Multi-factor authentication on every company account.
- No jailbroken or rooted devices.
Enforcing this at sign-in is the core idea of zero trust access: before granting access to each app, check who the person is and whether the device meets the bar. A device that falls out of compliance loses access until it’s fixed.
Keep data where it belongs
Device rules protect the device. Data rules protect the information:
- Limit which apps can open company files.
- Block downloads of sensitive files to unmanaged devices, or allow viewing in the browser only.
- Use data loss prevention to catch sensitive data heading to personal email or storage.
- Use a business password manager so work credentials aren’t saved in personal browsers.
Respect employee privacy
A BYOD program fails when people feel watched. Be explicit about what the company can and cannot see. With app protection, the company typically sees the work apps and their data, not personal photos, messages, browsing or location. Put that in writing in the policy. It builds trust and improves adoption.
BYOD policy checklist
- Who may use personal devices, and for which data and apps
- Minimum device requirements, enforced at sign-in
- The approach for each device type (managed, app protection, browser-only)
- What the company can see and do on a personal device
- How to report a lost or stolen device, and how fast
- What happens to company data when someone leaves
- Rules for shared family devices
- Employee acknowledgment
Where to start
If you don’t know which personal devices already reach your company data, start there. Sign-in logs from your email and identity provider usually show it within a day. From there, turn on device checks for your most sensitive apps first and expand.
If you’d like help, our zero trust access rollout covers personal and contractor devices as part of the plan. For a broader picture of your exposure, take the free security assessment.