Your BYOD Policy – Where do you start? (pt.4)

I discuss policies with clients a lot. This includes just asking to see them when I start an IT and Cyber Security Audit or when I am booked to deliver some Cyber Security Awareness Training. I am never surprised when they do not exist or possibly even worse, “not fit for purpose”. In “not fit for purpose” I include too long.

BYOD The opening gambit.

I believe for your Bring-Your-Own-Device (BYOD) policy to be effective it needs to be an agreement between you and the user, not just a list of restrictions. As I discussed in the first part of this series there are benefits on both sides for the employee using their equipment for your business but there are also risks for the organisation. If you get a true buy-in from the employee then they will be working with you to reduce the risk to your information.

Some good BYOD words…

Here are some suggestions for some essential concepts to include in your policy early:

• The organisation grants its employees the privilege of using their own smartphones and tablets, of their choice, at work for their convenience.
• This BYOD Policy is intended to protect the privacy, security and integrity of the organisation’s data and technology infrastructure against the risks that can arise when employees use their personally owned devices for business purposes.

These two sentences clearly set out that BYOD has benefits but that the organisation has to take steps, detailed in this policy, to protect its information when accessed from these devices. There is also no harm in informing a user that allowing them to use their own devices is a privilege. You must have the mindset to stop employees using their own devices, if the risks outweigh the benefits.

Next…

We will look again at the “what”.

Further Reading

A BYOD Primer

BYOD Bring-Your-Own-Device – A Primer (pt.1) | Smart Thinking Solutions

BYOD – Where do you start? (pt.2) | Smart Thinking Solutions

A Real-World Example – BYOD A Primer (pt.3) | Smart Thinking Solutions

Cyber Security Awareness Training

What is involved in an IT and Cyber Security Audit?

Photo by fauxels