We have a remote team. They open company email and customer files on their personal laptops. This seems very risky but I can't ban it.
How do you configure a device policy? Can company data be accessed on personal devices?
Are measures like antivirus and VPN enough?
Opening company data on personal devices is risky. Policy: Providing company-owned devices is ideal, but if you have to use 'BYOD' (Bring Your Own Device), the rules must be strict.
Protocol: VPN mandatory, antivirus must be installed, company files must be kept encrypted.
Have them sign a written agreement — the employee must accept in writing that they 'understand these risks'.
were in the same boat we gave out laptops for remote work but they still use personal devices and tbh we relaxed a bit with VPN
BYOD policy: 1. Mandatory VPN 2. Antivirus installed 3. OS updated 4. Encrypt files 5. Wipe all data upon resignation
Use MDM (Mobile Device Management) software. You can remotely wipe company data. Keep passwords in BitWarden.
keeping data on personal devices is dangerous... if an employee loses their laptop the data is gone. big risk
If you use BYOD, a written policy is mandatory. The company cannot be held liable for data loss from an employee's personal device.
Generally correct, but one part is missing. When making a decision, first look at what data you have on hand.
Proven by experience.
Sorry, but this doesn't apply in every case. If it's your first time, start small; scaling comes later.
Taking measures without an inventory leaves doors you haven't seen open. Just leaving this note, it might be useful.
Doki · SEO consulting · 2024
Thanks for writing this, that's the right way. Hasty decisions become decisions you have to fix six months later.
Hope this helps.
Let me summarize the topic, since several different answers were given. Everyone rushing into employee device policy gets stuck at the same point.
Good luck with that.
Doki · Phishing awareness training · 2026
Thanks, this was very helpful. If you don't write this down from the start, it leads to arguments later.
That's all, sorry if I went on too long.
The opposite happened to me, that's why I'm writing. An automated scan report is not the same as a penetration test.
If you post the result here, it will help others too.
Here's how it went for us. If you don't write this down from the start, it leads to arguments later.
If it's your first time, start small; scaling comes later. This is my opinion I'm not claiming it's absolute truth.
Good call starting this thread. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.
I'm also curious if anyone does it differently.
There's also a measurement aspect to this. The answer varies greatly by industry; there is no one-size-fits-all rule.
If you post the result here it will help others too.
don't miss this: Tring to do this alone is the most expensive way.
the harder it is to rveerse a decision the slower you should make it. that's all sorry if I went on too long.
i've been dealing with this for a long time. tbh having backups accessible on the same network and with the same identity makes them part of the target.
if you have questions wriet them; I'll answer as best I can.