[img src=”/wp-content/uploads/sites/2/2019/08/img-blog-deciding-which-devices.jpg” class=”aligncenter”]
Bring Your Own Device (BYOD) policies are here to stay. See how Uprite delivers remote IT services for Texas businesses. The flexibility, familiarity, and increased productivity that personal devices provide has forced companies to adapt to this workplace revolution in a hurry. Yet many companies are still struggling to strike the right balance between personal freedom and corporate responsibility. In part one of our two-part article, we’ll detail a six-step plan for developing the strategy and policy necessary to manage BYOD effectively.
Gather Your Team
Don’t go this alone. As you begin making a detailed plan for allowing the use of personal devices, get your employees involved, and keep in mind, the more the merrier. You want as much feedback, input, and honesty as you can handle. Taking the time to wade through everyone’s concerns is the best way to get the full picture. You need to determine how much freedom your employees are expecting, what your IT department can handle, and any concerns your legal department might have so everyone has raised red flags before issues arise. Remember, there is no one-size-fits-all approach to creating a BYOD policy so you’ll need to restructure your management style to fit the employees you have, the systems you use, and the regulatory requirements your company must meet. The goal is to create a strategy that doesn’t compromise data security yet still satisfies your employees.
Think Long Term
The goal of your company is to grow, so when developing a BYOD policy, don’t be reactive, be proactive. Ensure that, as you design your solutions, they can support a greater number of devices or users when needed. Make sure your policies won’t need to be rewritten every time a new sub-contractor is hired, or a new technology emerges. Today your employees have cell phones and tablets, in a few years (or months) they might be keen on wearables or smart desks. Ideally, you want to be endpoint independent in your approach so you can quickly adapt to innovative new devices and emerging platforms.
Assess Risk and Assign Access
Now that you have an overview, it’s time to decide the details of how you’ll protect your sensitive data.
Start by deciding which devices are acceptable within your company. You’ll accomplish this by weighing a combination of factors including what devices or apps your employees are already using (another great reason to check in with your staff before designing your policies), and which types can be easily monitored going forward. Create a list of acceptable devices and applications and be specific. A “choose your own device” model where employees select from a list of acceptable devices can help bridge the gap between secure options and personal preference.
Also, decide what sets of data you’ll allow to be transmitted on BYOD devices. An effective way of doing this is by adopting the principle of least privilege. This principle restricts access so users can only use the exact data and software required to do their job. In addition, implement multi-factor authentication to make sure you’re putting as many barriers between hackers and your company data as possible.
If you feel you need assistance from top-level experts, contracting a Managed Service Provider (MSP) can also help. Using an MSP like Uprite Services simplifies the process by having dedicated IT experts who can quickly assess your situation and create customized BYOD policies for your business. Contact Uprite Services today to learn more about how we can help.
Before You Write a BYOD Policy
Where do you even start with a BYOD policy?
Start by pulling employees, IT, and legal into the planning. You want honest feedback on how much freedom people expect, what IT can handle, and what legal is worried about, so red flags surface before problems do rather than after. There is no one-size-fits-all approach. Skip the template. Your policy has to fit your employees, your systems, and your regulatory requirements.
Will a policy written today still work in two years?
It can, if you build it to be endpoint independent. Design for more devices and users than you have now. Today it is phones and tablets, and in a few years or months it might be wearables or smart desks. Be proactive, not reactive. Policies shouldn’t need rewriting for every new subcontractor or emerging technology.
Which devices should you actually allow?
Only the ones on a specific, written list of acceptable devices and applications. Weigh what devices or apps employees already use, which is another great reason to check in with your staff first, against which types can be easily monitored going forward in your environment. One option is a choose your own device model, where staff pick from approved options. Be specific.
How do you limit what a personal phone can reach?
Apply the principle of least privilege, which restricts users to the exact data and software their job requires. Decide up front which sets of data are allowed on personal devices. Pair that with multi-factor authentication. More barriers help.
Could an outside IT partner take some of this off your plate?
A managed service provider can. Uprite’s dedicated IT experts can quickly assess your situation and create customized BYOD policies for your business. That helps if your team is stretched thin or wants an experienced second opinion before rollout.
