To write a BYOD security policy, decide which devices and data are in scope, set minimum security rules, and choose how you’ll protect company data. Then state plainly what you can and can’t see on a personal phone, and define what happens when a device is lost or someone leaves. Skipping this isn’t a neutral choice. Verizon’s 2025 mobile security datashows 70% of mobile devices hit by an attack were personal devices, not company-issued ones.

Your staff’s phones are already doing company work. A written policy decides the terms. Each step below becomes one clause in the copyable template near the end.

A BYOD Security Policy Is a Trade Between You and Your Staff

Put the deal in writing. Staff get to use their own phones, tablets or laptops for work. In return, your business gets a few clearly limited controls over its own data on those devices. BYOD stands for “bring your own device,” and for most SMBs and nonprofits it’s already how work happens.

Verbal rules fall apart the first time a phone goes missing or a manager leaves on bad terms. You need something staff read, sign and can point to.

The standards agree. NIST published SP 800-124 Revision 2, its updated guidance on managing mobile devices, on May 17, 2023. It covers company-provided and personally owned devices across their full life cycle. Back in 2013, the UK’s Information Commissioner’s Office gave the same first step for BYOD, which is a clear policy.

In September 2023, NIST’s National Cybersecurity Center of Excellence followed with SP 1800-22. It is a practice guide with an example BYOD security and privacy solution, built from existing standards and commercially available products. Its executive summary warns that a poorly secured personal device could expose the organization or the employee to data loss or a privacy compromise. A good policy protects both sides.

Your BYOD rules are one chapter of your overall cybersecurity policy template. Keep the wording and the named owners consistent between the two.

Personal Phones Are Where Mobile Attacks Land

Mobile attacks are rising, and phones make people click. In Verizon’s 2025 survey, 85% of organizations reported that mobile attacks were increasing.

Verizon’s 2026 breach investigations research found that mobile-focused phishing simulations, using voice calls and text messages, had a median click rate 40% higher than email. Keepnet, which supplied that simulation data, puts the medians at 2% for phone-based tests and 1.4% for email. A fake text from your executive director lands on the same screen as messages from family. That makes it easy to trust.

When something slips through, it’s expensive and slow to find. IBM puts the global average cost of a data breach at a record USD 4.99 million, up 12% from the year before. Breaches also took an average of 247 days to identify and contain. Your bill would be smaller than a global average. So is your cash reserve.

Choose MDM or App Protection Before You Write a Word

For most Canadian SMBs and nonprofits, app-level protection should be the default for personal devices. Keep full device management for the exceptions. This is your first risk management decision, and it shapes every clause that follows, from privacy to wiping.

The two models differ in how far they reach. Mobile device management (MDM) manages the whole device. Mobile application management (MAM), often called app protection, manages only your company’s apps and the data inside them.

App protection is mature enough for everyday work. Microsoft Intune app protection policies, for example, can protect company data on BYOD devices that aren’t enrolled in MDM. One setting blocks users from copying company data into personal apps. An employee can read client email in the work app but can’t paste a client’s details into a personal notes app.

Protect the company’s data, not the employee’s phone. A setup that touches only work apps is an easier ask. Demand the whole device, and you risk staff checking work email in a browser where you have no controls at all. Save full MDM for devices that hold highly sensitive records, or where a client contract or regulator requires it.

Step 1: Define Who and What the Policy Covers

Scope comes first because a policy that doesn’t say who it covers ends up covering nobody. Name the groups allowed to use personal devices for work. In a nonprofit, that list often includes volunteers and board members. They handle donor or client information on their own phones and rarely get asked about it.

Recording the enrollment date in the register also gives you a dated proof of consent if a wipe is ever disputed.

Next, list the device types you’ll support, such as phones, tablets and laptops, and set a minimum operating system version. A sensible rule is any version the manufacturer still supports with security updates. Rule out devices whose built-in protections have been removed, known as jailbroken or rooted devices.

Then describe enrollment. A device gets registered before it touches company data, never after. The employee signs the policy, installs your management or app protection tool, and IT confirms the device meets the minimum rules. Keep a simple register with the owner’s name, device type and enrollment date. You’ll need it on the day someone leaves.

Step 2: Write Security Requirements as Rules You Can Check

Every security requirement in a BYOD policy should pass a yes-or-no test, because “keep your device secure” can’t be checked and won’t be followed. These are the minimums most small organizations should require.

Callback rules work because attackers can spoof a caller ID or sender name, but they cannot answer a number you already trust.

• Screen lock. A passcode of a minimum length you set, with auto-lock after a set number of minutes. Match the length to your strong password policy.
• Encryption. Device storage encryption turned on, confirmed at enrollment.
• Updates. Operating system and app updates installed within a set number of days of release. Current software closes known holes that attackers rely on.
• Trusted apps only. Apps installed from the official app stores, never from links in texts or emails.
• Multi-factor sign-in. MFA on every company account reached from the device, so a stolen password alone can’t open your email. The benefits of multi-factor authentication are biggest on phones that leave the office every day.

If your tool can check these rules automatically, let it block access when a device falls out of line. That’s kinder than a reprimand and faster than an audit.

Step 3: Limit What Personal Devices Can Reach

Personal devices should reach the systems people need on the go and nothing more. For most teams, that means email, calendar, chat and file sharing through approved apps. Write that list into the policy by name.

Making the less drastic option the default encourages faster reporting, which shortens the window an attacker has with a lost phone.

Then write the opposite list. Payroll records, full client or donor databases, health information and admin consoles usually belong here. If someone needs those, they use a company device. The cybersecurity risks of digital access grow with every system a personal phone can open.

Spell out how devices connect, too. Sensitive work shouldn’t happen over open public Wi-Fi in a café or airport without the protection your IT team specifies, such as a company VPN or the phone’s own mobile data. In the office, put personal devices on a guest network, apart from the machines that run your business.

Step 4: Write Acceptable Use Rules That Cover Phone Scams

Acceptable use rules for personal devices need to treat a suspicious text or call as seriously as a suspicious email. Smishing is phishing by text message, and vishing is phishing by voice call. Both are social-engineering attacks built for phones.

Start with separation. Company data stays inside approved work apps. Staff don’t forward work files to personal email or personal cloud storage. Family members don’t use the work apps, even on a shared tablet.

Make reporting a duty. Anyone who gets a strange text or call about payments, passwords or login codes reports it to a named person within a set time. Add a rule that no payment or password reset is approved on the strength of a call or text alone. Staff call back on a number they already have.

People matter as much as settings here. IBM attributes 23% of data breaches to human error. A written rule gives staff permission to pause and check. That pause is the habit that helps protect your data on a phone.

Step 5: Put in Writing What You Can and Can’t See

The privacy clause decides whether staff trust your BYOD policy enough to enroll. Many employees assume “company management” means the boss can read their texts. With app protection that isn’t the case, and your policy should say so in plain words.

The table below is a starting point for an app-protection setup. Check it against what your own tool collects before you publish it.

Being this specific also supports your privacy obligations, because staff know exactly what you collect and why. If you choose full MDM, the “Yes” column gets longer. Update the table to match, and tell staff before they enroll.

Step 6: Plan for Lost Phones and Departing Staff

Set a reporting deadline for lost devices and a fixed checklist for departures, then follow both every time.

Lost or Stolen Devices

A lost device should be reported within hours, not days, to a named contact. Staff should report even when they think the phone is probably in the car. Then remove the company data, not the person’s life. A selective wipe removes work apps and data and leaves photos, messages and personal apps alone. A full wipe erases everything. Staff who know selective wipe is the default have less reason to delay a report. If the device held sensitive records, treat the loss as a possible incident and follow your data breach response plan.

Departing Employees

Run this checklist on the last day, whether the departure is friendly or not. The friendly ones are the ones people forget.

1. Disable the person’s company accounts and sign them out of active sessions.
2. Run a selective wipe to remove company apps and data from each enrolled device.
3. Remove the device from your management tool and your enrollment register.
4. Change any shared passwords or codes the person knew.
5. Get written confirmation that no company files remain in personal storage.
6. Record the date, the devices covered and who completed each step.

Step 7: Make the Policy Stick After Rollout

Get a signature from each person at enrollment, and again whenever the policy changes. An unsigned policy is one you can’t enforce. Keep signed copies with your enrollment register.

Pair the signature with a short walkthrough. Cover the passcode and update rules, how to spot smishing and vishing, who to call about a lost device, and what the business can and can’t see. A quick session in a team meeting does more than a PDF sitting in an inbox.

Review the policy once a year. Do it sooner when you change tools, add device types or take on a client with new compliance demands. NIST SP 800-124 Revision 2 and SP 1800-22 make a useful benchmark. You don’t need to match them line for line. Use them to spot gaps.

Copy This BYOD Security Policy Template

This BYOD security policy template turns the seven steps into clauses you can paste into a document. Replace every bracketed field, then have your HR lead or legal advisor read it before rollout.

1. Purpose. [Organization name] allows eligible people to use personal devices for work. This policy protects company data on those devices and respects the owner’s privacy.
2. Scope. This policy applies to [employees, contractors, volunteers, board members] who use a personal [phone, tablet, laptop] to access [email, calendar, chat, file storage].
3. Eligible devices and enrollment. Devices must run [operating system and minimum version] and still receive manufacturer security updates. Jailbroken or rooted devices are not permitted. Before accessing company data, you must sign this policy and install [management or app protection tool]. [IT contact] will confirm the device meets Clause 4.
4. Security requirements. Your device must have a passcode of at least [number] digits or biometric unlock, and auto-lock after [number] minutes. Encryption must be on. Install operating system and app updates within [number] days. Install apps from official app stores only. Use multi-factor authentication on all company accounts.
5. Access limits. Personal devices may access [approved systems and apps]. They may not access or store [payroll, full client or donor records, health information, admin tools]. Sensitive work on public Wi-Fi requires [company VPN or mobile data].
6. Acceptable use. Company data stays in approved work apps. Do not forward company data to personal accounts or let others use the work apps on your device. Report suspicious texts, calls or messages to [contact] within [time]. Confirm any request for payment, passwords or login codes by calling a known number.
7. Privacy. [Organization name] can see [company app data, device model, operating system version, compliance status]. It cannot see [personal photos, messages, call history, personal apps, browsing]. [Organization name] does not track your location.
8. Lost or stolen devices. Report a lost or stolen device to [contact] within [hours]. [Organization name] will remove company data with a selective wipe. A full wipe happens only [with your written consent].
9. Leaving the organization. On your last day, [Organization name] will revoke your access and remove company apps and data from your devices. You will confirm in writing that no company data remains in your personal storage.
10. Costs and support. [Organization name] [does / does not] contribute to [phone plan or device costs]. IT support covers [company apps only].
11. Violations. Breaking this policy may lead to removal of BYOD access and [disciplinary steps under your HR policy].
12. Review. [Role] reviews this policy every [number] months and after major tool or device changes. Last reviewed [date].
13. Acknowledgement. I have read this policy and agree to follow it. Name [____] Device [____] Date [____] Signature [____]

Simulations measure clicks under test conditions, so they show relative risk between channels rather than how often real attacks succeed.

Quick Answers on BYOD Policies

Do we need MDM for a BYOD policy? Usually not. App protection covers email, files and chat on personal phones for most SMBs and nonprofits, while full MDM fits devices holding highly sensitive data.

Can we wipe an employee’s personal phone? Your policy should allow a selective wipe of company apps and data. A full wipe of a personal device should require the owner’s written consent.

What happens when an employee leaves? On their last day, revoke their accounts, selectively wipe company data from their devices and remove them from your register. Then get written confirmation that no company files remain.

How often should we review the policy? At least once a year, and whenever your tools, device types or client requirements change.

Start With Your Next New Hire

You don’t need a company-wide rollout to begin. The next time a new hire asks for work email on their phone, fill in the template together. Get it signed before the account syncs. That one signature is your first real control over company data on personal devices.

Book a discovery call to talk through your rollout. Or get RiskAware’s free cybersecurity score to see where personal devices sit among your other cyber risks.