Personal devices at work: the BYOD rule that decides half your scope

The rule, precisely

A personal device — phone, tablet or laptop — is in scope if it accesses work email, files or any business data. It is exempt only if it is used solely for the phone’s built-in calls and texts, or two-factor codes. That exemption is deliberately narrow: a phone that receives a two-factor code is fine outside scope; the same phone with the work mailbox added is in, exactly as if the business owned it.

“Accesses” includes the browser. Checking work email through a phone’s web browser, or opening a shared document from a link, is access — the rule is about where business data goes, not which app displays it.

What an in-scope personal device must meet

Everything a company device must meet — the five controls apply in full. For a phone that mostly means four things:

• A supported operating system, listed in your scope with its version. An old personal phone that stopped getting updates is an automatic fail in scope, so it either gets replaced or stops being used for work.
• Updates applied — automatic updates on, within the 14-day rule like everything else.
• A lock: fingerprint, face, password, or a PIN of at least 6 characters. A PIN that short is only enough where work apps still ask you to sign in; otherwise the full password rules apply. We also suggest locking automatically when idle.
• Official apps only: from the App Store or Google Play, only apps on the list your business has approved, on a device that isn’t jailbroken or rooted (A8.4, A8.5) — that is how phones meet the malware control.

A personal laptop also needs its software firewall on, anti-malware (or app allow-listing), unused software removed, and its work accounts protected by MFA — the same as a company laptop.

Nothing in the scheme requires the business to install management software (MDM) on personal devices. What it requires is that the device meets the rules; a short, honest BYOD policy that people actually agree to is how a small business usually assures that.

The conversation with the team

The fair framing is a genuine choice: if you use your own device for work, these rules apply to it; if you’d rather they didn’t, that’s fine — don’t use it for work, and we’ll sort a company device instead. What doesn’t work is the quiet middle ground where someone reads work email on a phone that everyone has agreed to pretend is out of scope. That phone is in scope by rule, and pretending otherwise means the scope statement you sign is wrong.

In practice most people accept the rules instantly, because they are things a sensible phone already does. The one that occasionally bites is the unsupported handset — and that is a real decision, not a form of words.

Writing it down

If any personal device is in scope, a one-page policy makes the answers consistent: who it applies to, the requirements, the calls-texts-MFA exemption, and the offer of a company device for anyone who opts out. The free BYOD policy template is that page, written the way ReadyCert drafts it. List the devices themselves in your asset register, marked as personal, with make and OS version (A2.6 for laptops, A2.8 for phones and tablets).

Where people go wrong

• Leaving personal phones off the scope list while the whole team reads email on them. This is the most common scope error there is.
• Claiming the exemption too broadly. “They only use it a bit” is not calls-texts-MFA-only.
• Forgetting the director. The owner’s own phone is usually the most data-heavy personal device in the business.
• Missing the leaver angle. When someone leaves, work accounts come off their personal device when their logins are disabled — the same day is a good habit.