BYOD (Bring Your Own Device) Policy

1. Purpose

The purpose of this BYOD Policy is to define security requirements for the use of personally owned devices to access organizational information, applications, systems, and services.

The policy aims to balance employee flexibility with the protection of:

Organizational information
Customer information
Personal data
Credentials
Source code
Business applications
Cloud infrastructure
Security information
Confidential and restricted information

BYOD introduces additional risks because the organization may not have full administrative control over personally owned devices.

2. Scope

This policy applies to employees, contractors, consultants, interns, and other authorized users who use personally owned devices for organizational activities.

Covered devices include:

Personal laptops
Personal desktops
Smartphones
Tablets
Other personally owned computing devices

It applies when personal devices are used to access:

Corporate email
SaaS applications
Cloud platforms
Business applications
Source-code repositories
Collaboration tools
Corporate networks
Customer systems
Organizational information
Security or administrative systems

3. BYOD Principles

BYOD shall follow these principles:

Authorization – Personal devices may be used only when BYOD is permitted and approved.
Risk-based access – Access should depend on the sensitivity of information and systems involved.
Least privilege – Users receive only the access required for their role.
Strong authentication – MFA should be used for corporate systems.
Device security – Personal devices must meet defined minimum security requirements.
Data minimization – Organizational information should not be stored locally unless necessary.
Separation – Business and personal information should be separated where technically possible.
Monitoring transparency – Users should understand what security information the organization collects from BYOD devices.
Privacy – Security controls should respect applicable privacy and employment requirements.
Secure offboarding – Organizational access and information must be removed when BYOD authorization ends.

4. BYOD Authorization

BYOD should not automatically be permitted for all systems.

The organization should determine whether BYOD is appropriate based on:

User role
Device type
Information classification
Application sensitivity
Customer requirements
Regulatory requirements
Security risk
Technical controls
Ability to manage the device
Ability to remove organizational information

A risk assessment may be required before allowing BYOD for sensitive or privileged activities.

5. Permitted and Restricted BYOD Activities

A simple risk-based model can be used.

Activity	BYOD Status
Corporate email	May be permitted with controls
Collaboration tools	May be permitted
Internal business applications	May be permitted
Low-risk SaaS applications	May be permitted
Confidential information access	Requires appropriate controls
Customer data download	Restricted
Source-code access	Risk-based
Production administration	Generally restricted unless specifically approved
Privileged cloud administration	Highly restricted
Storage of credentials/secrets	Prohibited
Access to production databases	Restricted
Security administration	Requires explicit authorization

These classifications are examples. The organization should define actual permissions based on its risk assessment.

6. Minimum Device Security Requirements

A personal device approved for business use should meet applicable minimum requirements.

Depending on device type and risk, requirements may include:

Supported operating system
Current security patches
Screen lock
Strong authentication
Device encryption
Security software where appropriate
Firewall enabled where applicable
Automatic locking
Secure browser
No unauthorized/rooted/jailbroken configuration
Ability to remove organizational access
Secure backup where required
No shared use for corporate access

Devices that do not meet minimum requirements may be denied access.

7. Device Registration

Where appropriate, BYOD devices should be registered before accessing organizational systems.

The organization may record:

User
Device type
Operating system
Device identifier
Security status
Approved applications
Enrollment status
Date approved
Date last checked
BYOD status

Only the minimum information necessary for security and administration should be collected.

8. Mobile Device Security

Personal smartphones and tablets used for organizational purposes should have:

Screen lock
Supported operating system
Security updates
Device encryption where available
MFA for corporate applications
Approved business applications
Protection against unauthorized access

Users should not disable security features required for corporate access.

Lost or stolen devices must be reported promptly.

9. Personal Laptop Security

Where personal laptops are permitted:

The operating system must be supported.
Security updates must be installed.
Disk encryption should be enabled where required.
Screen locking must be enabled.
Security software should be installed where required.
Corporate information should be stored only in approved locations.
Corporate credentials must not be shared.
Family members or other unauthorized users should not use the device for corporate access.

Where technical controls cannot adequately secure a personal laptop, the organization may require a corporate-managed device instead.

10. Authentication and MFA

Users accessing organizational systems from personal devices must use approved authentication mechanisms.

Controls may include:

MFA
Single Sign-On
Strong authentication
Conditional access
Device compliance checks
Risk-based authentication
Passwordless authentication

MFA should be mandatory for sensitive systems where supported.

Example:

Personal Laptop → Identity Provider → MFA → Conditional Access → Approved SaaS Application

11. Access Control

BYOD access must follow the organization’s Access Control Policy.

Users should receive:

Role-based access
Least privilege
Need-to-know access
Appropriate authentication
Time-limited access where necessary

BYOD access should not automatically provide access to all systems available to a user from a corporate-managed device.

12. Access to Confidential and Restricted Information

BYOD access to confidential or restricted information should be controlled based on risk.

Where possible:

Prevent local downloads.
Use browser-based access.
Use approved virtual desktop or remote-access solutions.
Apply conditional access.
Use encryption.
Restrict copying and sharing.
Apply session controls.
Use data-loss prevention controls where appropriate.

Example:

An employee may view customer information through an approved SaaS application on a personal laptop but may be prevented from downloading the full customer database to that laptop.

13. Customer Data

Customer information must be handled according to its classification and contractual requirements.

Users should not:

Download customer databases unnecessarily.
Store customer data in personal cloud storage.
Copy customer information to personal USB drives.
Forward customer information to personal email.
Upload customer information to unauthorized applications.
Use customer information for personal purposes.

Where customer requirements prohibit BYOD access, those requirements take precedence.

14. Source Code and Development Access

Where developers are permitted to use personal devices, additional controls should be considered.

Requirements may include:

Approved source-code repository
MFA
Branch protection
Code review
Secure development practices
Secrets management
Endpoint security
Restricted production access
No storage of credentials in source code
No unnecessary storage of production data

Example

A developer may access a Git repository from a personal laptop using SSO and MFA.

However:

AWS production credentials should not be stored locally.
Production databases should not be downloaded.
Customer production data should not be copied to the device.
Secrets should be retrieved through approved secrets-management mechanisms.

15. Cloud and AWS Access

BYOD access to cloud environments must follow cloud security and privileged-access requirements.

For example:

Personal Device
↓
SSO + MFA
↓
Conditional Access / Device Check
↓
Approved AWS Role
↓
Least Privilege
↓
CloudTrail Logging
↓
Monitoring

Highly privileged AWS activities should generally require stronger controls and may require a managed corporate device, privileged access workstation, or other approved secure-access mechanism.

The AWS root account should not be used for routine administration.

16. BYOD and SaaS Applications

Only approved SaaS applications should be used for organizational information.

The organization should maintain an appropriate SaaS Application Register and assess applications based on:

Business purpose
Information processed
Data classification
Supplier security
Privacy
Access control
Contractual requirements
Data location
Retention
Security capabilities

Employees must not connect personal applications to corporate systems without authorization.

17. Personal Cloud Storage

Organizational information must not be stored in personal:

Google Drive
OneDrive
Dropbox
iCloud
Personal email
Personal file-sharing services
Other unauthorized storage services

Corporate information should be stored using approved organizational platforms.

18. Removable Media

The use of USB drives or other removable media on BYOD devices should be restricted according to risk.

Users should not copy confidential or restricted information to personal removable media unless specifically authorized.

Where removable media is approved:

Encryption should be used where appropriate.
Information should be minimized.
The media should be protected from loss or theft.
Disposal should be secure.

19. Local Storage and Downloads

Users should minimize storing organizational information locally on personal devices.

Where local storage is unavoidable:

Information should be appropriately protected.
Sensitive files should be encrypted where required.
Unnecessary copies should be deleted.
Files should not remain on the device after the business purpose ends.

The organization may implement technical controls to restrict downloads of sensitive information.

20. Personal and Organizational Data Separation

Where technically possible, organizational information should be separated from personal information.

Examples include:

Managed work profiles
Containerization
Virtual desktops
Browser isolation
Approved business applications
Separate corporate accounts
Remote application access

The objective is to allow the organization to protect corporate information without unnecessarily accessing personal information.

21. Monitoring and Privacy

Because BYOD involves personally owned devices, monitoring must be proportionate and transparent.

The organization should clearly communicate:

What security information may be collected
Why it is collected
What activities may be monitored
What information is not intentionally accessed
How monitoring information is protected
Who may access security information
How long security information is retained

Monitoring should comply with applicable privacy, employment, and legal requirements.

22. Security Software and Device Management

Where justified by risk, the organization may require BYOD devices to use security or management controls such as:

Mobile Device Management (MDM)
Mobile Application Management (MAM)
Endpoint Detection and Response (EDR)
Endpoint protection
Device compliance checks
Conditional access
Remote removal of corporate data

The organization should consider employee privacy before deploying management capabilities on personally owned devices.

23. Lost or Stolen BYOD Device

Users must immediately report a lost or stolen BYOD device that has access to organizational systems.

The organization may:

Revoke sessions.
Disable access.
Reset or revoke credentials.
Remove corporate application access.
Remotely remove corporate data where technically supported.
Review authentication and access logs.
Assess whether organizational information was exposed.
Determine whether an information security incident occurred.
Perform required legal, regulatory, or contractual assessments.
Document the incident.

24. Malware or Compromised Device

If a BYOD device is suspected of being compromised, the user should:

Stop accessing organizational systems where practical.
Report the issue to IT/Security.
Follow security instructions.
Avoid attempting unauthorized investigation or removal of evidence.
Change credentials if instructed.
Allow security teams to assess the affected corporate access.

The organization may block the device from accessing corporate resources until security requirements are restored.

25. BYOD and Remote Working

BYOD is closely related to the organization’s Remote Working Policy.

When employees work remotely using personal devices, they must follow both:

Remote Working Requirements + BYOD Requirements

For example:

Personal Laptop
→ Device Security
→ MFA
→ Secure Network
→ Approved Application
→ Least Privilege
→ Data Protection
→ Monitoring
→ Incident Reporting

26. Offboarding and BYOD Access Removal

When employment, contract, role, or BYOD authorization ends, the organization should:

Disable corporate accounts where applicable.
Revoke active sessions.
Remove device access.
Remove corporate applications or profiles.
Remove organizational data where technically supported.
Revoke certificates/tokens.
Revoke VPN access.
Revoke cloud access.
Confirm that organizational information is no longer retained on the personal device where required and technically feasible.

The organization should not unnecessarily access unrelated personal information.

27. BYOD Access Review

BYOD access should be periodically reviewed.

The review should consider:

Authorized users
Registered devices
Device compliance
Application access
Privileged access
Dormant users
Users who changed roles
Departed employees
Lost devices
Unsupported operating systems
Security exceptions

Access that is no longer required should be removed.

28. BYOD Risk Assessment

Typical BYOD risks include:

Risk	Example Control
Device theft	Encryption, screen lock, remote removal
Malware	Endpoint protection, device compliance
Credential theft	MFA, conditional access
Customer data leakage	DLP, download restrictions
Personal cloud storage	Approved storage policy
Family member access	Screen lock, separate work profile
Unpatched device	Minimum patch requirements
Lost device	Immediate reporting and access revocation
Shadow IT	SaaS approval process
Production compromise	Restrict privileged BYOD access
Privacy conflict	Transparent and proportionate monitoring

These are example risks. The organization should perform its own risk assessment based on its actual environment.

29. Exceptions

Exceptions to BYOD requirements should be:

Documented
Risk assessed
Approved by an authorized person
Assigned to an owner
Time-bound where practical
Periodically reviewed

High-risk exceptions should receive appropriate management approval.

30. Employee Responsibilities

BYOD users are responsible for:

Keeping their devices secure.
Protecting organizational credentials.
Using MFA.
Installing required security updates.
Protecting organizational information.
Following access-control requirements.
Avoiding unauthorized applications.
Reporting loss, theft, or compromise.
Following the Acceptable Use Policy.
Following the Remote Working Policy.
Cooperating with approved security controls.

31. IT and Security Responsibilities

IT/Security should:

Define minimum BYOD security requirements.
Approve or restrict BYOD access.
Implement appropriate authentication controls.
Monitor security events where justified.
Manage corporate application access.
Revoke access when required.
Respond to compromised devices.
Maintain relevant records.
Periodically review BYOD risks and controls.

32. Evidence and Records

Evidence may include:

BYOD authorization records
Device registration records
Device compliance reports
MDM/MAM records
MFA configuration
Conditional-access policies
Access reviews
User acknowledgements
Security awareness records
Incident records
Device-loss reports
Application access records
Exception approvals
Risk assessments
Offboarding records
Corporate-data removal records

The policy itself should not be treated as sufficient evidence that BYOD controls are operating effectively.

33. Startup-Friendly BYOD Model

A startup does not necessarily need full device management for every personal device.

A practical risk-based model can be:

Low-Risk Access

Personal Device → MFA → Approved SaaS → Limited Data Access

Medium-Risk Access

Personal Device → Security Requirements → MFA → Conditional Access → Approved Application → Monitoring

High-Risk Access

Corporate-Managed Device → MFA → Privileged Access → Strong Monitoring → Restricted Data Access

Highly Privileged Production Access

Managed Device / Approved Secure Access → MFA → Privileged Role → Temporary Access → Logging → Monitoring → Review

This allows the organization to support BYOD without treating every application and every type of information as having the same risk.

34. Quick BYOD Audit Checklist

Check	Status
BYOD is formally authorized	☐
BYOD risks are assessed	☐
Minimum device requirements are defined	☐
Supported operating systems are defined	☐
MFA is required	☐
Device encryption is addressed	☐
Security updates are required	☐
Corporate and personal data are separated where practical	☐
Confidential data access is controlled	☐
Personal cloud storage is restricted	☐
Production access is restricted	☐
Privileged access is appropriately controlled	☐
Lost/stolen device procedure exists	☐
BYOD incident reporting is defined	☐
BYOD monitoring is transparent	☐
Privacy requirements are considered	☐
BYOD access is periodically reviewed	☐
Offboarding removes corporate access	☐
Exceptions are documented	☐
Evidence is retained	☐

35. Relationship with Other ISMS Documents

The BYOD Policy should connect with:

Information Security Policy
Remote Working Policy
Acceptable Use Policy
Employee IT Usage Policy
Access Control Policy
Asset Inventory
Asset Classification Procedure
Data Inventory
Data Protection/Privacy Policy
SaaS Application Register
Cloud Asset Inventory
Security Awareness Policy
Incident Response Plan
Security Incident Management Procedure
Risk Assessment and Risk Register
Supplier Security Assessment
Offboarding Procedure

A useful control relationship is:

BYOD → Device → User → Authentication → Access → Information → Risk → Controls → Monitoring → Incident → Offboarding

36. ISO 27001 Connection

BYOD should be addressed through the organization’s information security risk management process and applicable controls.

Relevant ISO/IEC 27001:2022 Annex A areas can include:

Information security policies
Mobile device controls
Access control
Authentication information
Identity management
Endpoint security
Information classification
Information transfer
Data leakage prevention
Remote working
Logging and monitoring
Incident management

The exact controls applicable to the organization should be determined through its risk assessment and control-selection process and reflected in the Statement of Applicability.

As with other ISMS policies, having a BYOD document alone does not demonstrate effective implementation. The organization should be able to provide operational evidence such as MFA, device controls, access reviews, incident records, device registration, and offboarding records.

37. Final Principle

A secure BYOD program should follow:

Authorize → Register → Secure Device → Authenticate → Control Access → Minimize Data → Protect → Monitor → Report → Revoke → Review

The objective is not simply to allow or prohibit personal devices.

The objective is:

Allow personal devices where the business needs them, while ensuring organizational information remains protected and organizational access remains under control.

ISO/IEC 27001