4 Keys for a Small Business BYOD Policy
This article was updated on June 12, 2018.
You've likely heard that a bring-your-own-device (BYOD) policy can help your business reduce costs, improve data management and support the needs of today's increasingly mobile, hyper-connected workforce. However, there are risks associated with BYOD, the most dire of which include unauthorized access to sensitive information and data loss. Having a strong small business BYOD policy in place can help mitigate these risks.
Here are the four key components of a good BYOD policy:
1. Determine Who Is Eligible
Your BYOD policy should clearly outline which personal devices employees can use to complete work tasks, connect to your company network and access sensitive information. If you're supporting smartphones, are you supporting Android phones in addition to iPhones? What about tablets and laptops? You'll need to clarify for all employees which devices may or may not be compatible.
2. Create and Communicate BYOD Security Rules
Many companies' BYOD policies require users to implement passwords or lock screens on their personal electronic devices. Users may view this rule as an obstacle to quick, convenient access to the data on their device — but that's the whole point. Allowing any unauthorized user to swipe and gain access to your data represents an unacceptable risk.
If employees want to access your company's data and systems via their personal devices, they'll need to follow rules that protect your data, including having complex password protections on their devices. Good, constant communication can help drive compliance.
Keeping in mind workplace privacy laws, consider reserving the right to wipe the device if it's lost or stolen. This may get messy when personal and work-related data are on the same device. Employers who intend to reserve the right to wipe data under these circumstances should communicate this to employees in any BYOD policy or agreement so he or she can back up personal data.
On that note, employers should also make clear that they reserve the right to monitor, review or maintain any communications sent through their devices over the company network.
3. Define What Will Be Banned
What happens when BYOD users download, install and use applications that represent a security risk on a device that has access to your most sensitive business data? An effective BYOD policy will alert employees to any anti-virus or other related software that will be installed to prevent misuse of senstivie business data. Again, following rules that protect your small business data is the price users pay for the convenience of BYOD.
Beyond what employees are using their devices for, when employees are using them to complete work-related tasks should also be considered by employers before permitting them to use their devices at work. Specifically for non-exempt employees, rules should be put in place to ensure they are not working outside of working hours to prevent unauthorized overtime, which could expose employers to certain claims.
4. Have an Exit Strategy
What happens when employees with personal devices included in your BYOD program leave the company? Make sure that you have a policy in place that permits you to remove your data via their devices before they leave.
Follow the suggestions above to help maximize the benefits of a small business BYOD policy while reducing the security risks for your company.
