Checking your work email on your personal phone? Pretty common.
Opening a company document on your home laptop? Happens all the time.
Using the family computer to finish up a project after dinner? Well, that's where things can start getting interesting.
Allowing employees to use their own devices for work can be convenient, but it also creates security risks that many small businesses haven't really considered.
And sometimes, those risks show up long before anyone realizes there's a problem.
So, should your employees be using their personal devices for work?
The answer isn't necessarily yes or no. It's what they're accessing, how they're accessing it, and whether your business information is protected.
What Exactly Is BYOD?
There's a name for using personal devices at work: Bring Your Own Device, or BYOD.
It simply means employees use their own phones, tablets, or computers to access work-related information.
That might include checking company email, joining a Teams meeting, accessing Microsoft 365, opening customer files, or using business applications.
Seems harmless enough, right?
Sometimes it is.
But there's a big difference between checking your calendar on your phone and downloading sensitive customer information onto a laptop that your kids also use for homework and Minecraft.
Both involve personal devices. The security risks are very different.
The Problem Isn't Necessarily the Device. It's the Data.
When Layer 2 manages a business computer, we can help control important security settings, updates, and protections.
With a personal device, things aren't always so straightforward.
Employees decide which applications to install, when to update their devices, and who else might use them.
And once business information leaves a managed environment, it can be difficult to know where that information ends up.
For example:
- A work document gets downloaded into a personal folder.
- A home computer automatically backs up that folder to a personal cloud account.
- A family member uses the same computer account.
- An employee leaves the company, but work files remain saved on their personal laptop.
- A personal device gets lost or stolen while still signed into company applications.
None of these situations necessarily involves someone doing anything intentionally wrong.
But each creates an opportunity for business information to end up somewhere it shouldn't.
Convenience is great. Losing control of company data? Not so much.
Does That Mean Personal Devices Should Be Off-Limits?
Not necessarily!
For some businesses, allowing employees to use personal phones for work email or approved applications makes perfect sense.
The key is having rules in place before everyone starts connecting whatever device they happen to have handy.
For example, you might allow employees to access work email through an approved mobile app but require a company-owned computer for financial records, sensitive customer information, or administrative tasks.
Someone responsible for managing company accounts, security settings, or critical business systems should generally be using a properly managed company device.
And if an employee's personal computer is shared with other family members, that creates additional concerns.
The goal isn't to make work more difficult. It's to make sure employees have the access they need without putting company information at unnecessary risk.
A Few Security Basics Make a Big Difference
If your business allows personal devices, there are some basic protections that should be in place.
Keep devices updated.
Phones and computers need current operating systems and security updates. An outdated device can introduce vulnerabilities, even when the employee is simply checking email.
Require a screen lock.
A PIN, password, fingerprint, or facial recognition helps prevent unauthorized access if a device is misplaced.
Use multifactor authentication (MFA).
MFA adds another layer of protection to work accounts. It's especially important when employees access business information outside the office.
Protect stored information.
Device encryption helps protect information if a laptop or phone is lost or stolen. Approved work applications can also help limit where company files are saved or shared.
Keep work and personal information separate.
Whenever possible, use approved applications or separate work profiles to prevent business information from mixing with personal files.
Have a plan for lost devices.
Employees should know exactly who to contact if a personal phone or laptop containing business information is lost, stolen, or compromised.
And here's an important one: A personal device that can't meet your company's security requirements shouldn't be allowed to access company information.
Wait, Can My Employer See Everything on My Phone?
This is a question employees understandably have, and it's worth addressing.
The answer depends on how the device is managed.
Some security tools protect only specific business applications and their data. Others involve enrolling the entire device in a management system, which can give the business more visibility and control.
For example, Microsoft Intune offers ways to protect company information in approved applications without necessarily managing an employee's entire personal phone.
Depending on the setup, IT may be able to remove company data from those applications if a device is lost or an employee leaves.
That doesn't automatically mean the business can read personal text messages, look through family photos, or see everything an employee does.
However, the exact capabilities depend on the management method.
Employees should know what their employer can see, what can be controlled, and what information could be removed before agreeing to use a personal device for work.
Clear expectations protect both the employee and the business.
What Happens When Someone Leaves the Company?
Here's a situation businesses sometimes overlook.
An employee leaves, their company email account is disabled, and everyone moves on.
Problem solved?
Not necessarily.
What about the documents they downloaded to their home computer? Or the company files that were automatically backed up to personal storage?
Disabling an account doesn't automatically erase copies of information that have already been saved elsewhere.
That's one reason properly managed applications and clear policies are so important.
Your business needs a process for removing access, protecting company information, and making sure work-related data doesn't remain on personal devices after an employee leaves.
And ideally, that process should be established long before anyone gives their two weeks' notice.
What If a Personal Device Is Lost or Stolen?
First, don't panic. But don't wait to report it, either.
If an employee loses a device used for work, your IT provider may need to:
- Disable or restrict company access.
- Sign the employee out of active sessions.
- Remove company information from managed applications, when possible.
- Check for suspicious account activity.
- Determine whether any business information may have been exposed.
One important detail: Remote removal tools aren't magic.
If a device is offline, it may not receive the command to remove company information until it reconnects.
And information saved outside managed applications may not be removable remotely at all.
That's why encryption, strong sign-in protections, and limiting where company files can be stored are so important.
Every Business Needs a BYOD Policy (Even a Simple One)
You don't need a 40-page employee handbook to establish some basic expectations.
But if your employees are using personal devices for work, you should have a written policy explaining what's allowed.
At a minimum, it should answer a few questions:
- Which personal devices can employees use?
- What company information and applications can they access?
- Can business files be downloaded or saved locally?
- What security settings are required?
- What can the company or IT provider see and control?
- What happens if a device is lost, stolen, or replaced?
- How is company information removed when an employee leaves?
You should also decide who is responsible for device repairs, support, and any related costs.
And don't forget about contractors. If they access company information from their own devices, they need appropriate security requirements, too.
A little planning now can prevent some very uncomfortable conversations later.
Is BYOD Actually Saving Your Business Money?
At first glance, letting employees use their own devices sounds like an easy way to reduce equipment costs.
And sometimes it is.
But there can be additional expenses for security tools, device management, IT support, and the time involved in maintaining those protections.
There's also the question of what happens when someone's personal device isn't compatible with your business software or doesn't meet your security requirements.
Sometimes providing a company-owned computer is simply easier, more secure, and more cost-effective.
Especially for employees who regularly handle sensitive information or rely heavily on their computers throughout the day.
So, Should You Allow Personal Devices?
For some employees and some tasks, absolutely.
For others, a company-owned device is the better choice.
The important thing is making that decision intentionally instead of discovering that half your employees have been accessing company information from personal devices you didn't even know about.
At Layer 2, we help businesses manage and protect their technology, including setting up appropriate access and security controls.
If you're not sure which personal devices are accessing your company information, or whether your current protections are enough, we can help you take a closer look.
Because knowing where your business information lives is a pretty important part of keeping it safe.
Contact Layer 2 Computers to talk about protecting your business devices and data.
