M_Sample BYOD Policy

Example BYOD Policy

The device will only be permitted to access organisational data/services if:

·       The Operating System, software and Apps are fully supported by the manufacturer and receive regular security updates. 

·       Software based firewalls are activated and configured correctly. 

·       Security updates are applied within 14 days.  

·       Cyber Essentials password controls are applied to user’s own devices (BYODs). 

·       Users logging in on computers and tablets have a day-to-day account, and this is separate to the administrator account. 

·       The device automatically locks when not in use and requires a 6 digit or more pin/pass code to unlock, (use a biometric* if available). 

·       Anti-malware software also known as anti-virus software is installed on devices and kept updated.  For a mobile device, only apps from the manufacture’s respective store are allowed to be installed. 

·       Unused apps must be uninstalled. 

·       If lost or stolen, there is an obligation to report this promptly to Chambers . 

·       Rooting or Jailbreaking is not permitted. 

·       A remote erase and tracking app be installed and activated so you can track a lost device, lock access and erase data. Obtain written consent in advance from the device owner to remote wipe the device in the event of loss, theft or termination of employment.  

·       There is a set and agreed protocol for how, when and why monitoring will take place and a requirement the devices and passwords will be delivered up on reasonable request.

For further risk reduction 

·       Container Apps or Managed Apps are types of software that separate company data and personal data on the device and would enable the organisation to limit monitoring and remote wiping to company data only.  

·       Mobile Device Management software (MDM) allows you to monitor, manage, and secure employees’ mobile devices. There is a range of price models available for this software.  

It is worth noting that there are technologies out there which will greatly assist the central IT team in ensuring that BYOD parameters are agreed are adhered to, whilst minimising the disruption on end users. For example, Intune Company Portal is an App that is provided by Microsoft as part of the majority of their Office subscriptions which allows your IT team to safely and securely manage access to the central IT system’s apps, data and resources, once a BYOD device has been enrolled into the system.