Managing Company Devices: MDM, BYOD and Lost-Device Response

Your company's data lives on laptops, phones and tablets that leave the office every day. Device management tools let you set up, secure, update and, if necessary, erase those devices from one console, so security doesn't depend on each employee remembering the right settings.

This guide explains the main types of device management, how to choose between company-owned and personal devices, how to protect work data on personal phones without overreaching, and what to do when a device goes missing.

It is general information, not legal advice. Employee monitoring, privacy and data breach notification laws vary by state, so have an attorney review your device policies and help you decide whether a lost device requires notifying anyone.

MDM, MAM, EMM and UEM: Sorting Out the Terms

NIST's mobile device guidance, SP 800-124 Revision 2, published in May 2023, describes enterprise mobility management (EMM), "sometimes referred to as UEM (unified endpoint management)," as a solution used to deploy, configure and actively manage mobile devices. An EMM suite may include:

• Mobile device management (MDM): control of the whole device, such as settings, passcode rules and remote wipe.
• Mobile application management (MAM): control of specific work apps and the data inside them.
• Mobile threat defense: detection of threats on the device.

NIST's guidance covers phones and tablets and leaves laptops out of scope, but many management products handle both. Microsoft Intune's documentation, for example, lists Windows, macOS, iOS and iPadOS, Android and ChromeOS among the platforms its wipe action supports. NIST also notes that most organizations won't need every capability, so choose the ones that match your risks.

What Device Management Should Do

NIST lists policy controls EMM tools can enforce, including:

• Requiring a passcode or biometric to unlock the device
• Restricting hardware and features, such as cameras or copy and paste
• Detecting changes to the approved security configuration
• Limiting access to company services based on operating system version or whether a device has been rooted or jailbroken
• Disabling developer mode

For a small business, a sensible baseline for company devices adds full-disk encryption, automatic operating system updates, a screen lock timeout, a list of approved apps, an accurate inventory, and remote lock and wipe. Ideally, access to email and files is allowed only from devices that meet these rules.

Choose an Ownership Model

NIST describes a spectrum of deployment models:

• Strict enterprise use: the organization owns the device and controls it fully; personal use is tightly limited.
• Corporate-owned, personally enabled (COPE): the company owns the device and enforces restrictions, but allows some personal use. NIST notes that the device and its information still belong to the organization.
• Bring your own device (BYOD) and choose your own device (CYOD): employees use personal devices, either any device or one chosen from an approved list.

BYOD saves money but brings risk. NIST points out that with personal devices, the organization has little knowledge of where a device came from or whether it has been modified, and it may be rooted, jailbroken or infected without the user knowing. A common middle path is company-owned laptops for everyone, with personal phones allowed for email and chat under app-level protections.

Protecting Work Data on Personal Devices

You don't have to control an employee's whole phone to protect company data. The major platforms separate work from personal:

• Microsoft says Intune app protection policies can protect company data "without requiring device enrollment," for example by requiring a PIN to open work email, preventing copying company data into personal apps, and wiping only company data from an app.
• Apple says its account-driven User Enrollment is "designed for BYOD," and that IT teams can manage only the organization's accounts, settings and information, "never a user's personal account."
• Google's Android documentation describes a work profile controlled by IT, with storage separate from the user's personal profile.

Whatever you choose, tell employees plainly what the company can and cannot see or erase, and get their written acknowledgment. Our guide IT Policies Every Small Business Needs (With Simple Templates) includes a mobile device and BYOD policy outline.

When a Device Is Lost or Stolen

Speed matters, so practice this checklist before you need it:

1. Report it immediately. Make it easy and blame-free for employees to report a missing device as soon as they notice.
2. Lock and locate it. Use your management console to lock the device and check its last known location.
3. Cut off account access. Microsoft's guidance for emergencies is to disable the account if needed, revoke sign-in sessions and reset passwords. It notes that access tokens last one hour by default, so some apps may stay signed in briefly after you act.
4. Wipe it. Use a full wipe for company-owned devices, or an enterprise or selective wipe that removes only work data from a personal device.
5. Record the facts: what data was on the device, whether it was encrypted, when it was last used and, if stolen, any police report number.
6. Decide on notification with your attorney.
7. Replace the device and clean up records, including removing it from your inventory and identity system.

Don't rely on remote wipe alone. NIST explains that native remote wipe on iOS and Android requires the device to be powered on and connected, and calls remote wipe by itself "a fundamentally unreliable security control," because an attacker can read data first or keep the device offline. Encryption and a strong passcode set up in advance are what protect a device you never get back.

Whether encryption was enabled can also affect your legal obligations. The FTC notes that all states, the District of Columbia, Puerto Rico and the Virgin Islands have laws requiring notification of security breaches involving personal information, and its breach guidance advises finding out whether measures such as encryption were enabled when a breach happened.

Offboarding and Retirement

Devices leave with people. When an employee departs, recover company devices and perform a selective wipe of work data on any personal devices. NIST recommends wiping a device before reissuing it to another user or retiring it. Microsoft's Intune documentation also suggests removing wiped devices from your identity system so stale records don't linger.

Key takeaways

• EMM or UEM tools combine device management, app management and threat defense; choose only the capabilities you need.
• Set a baseline for company devices: encryption, passcodes, automatic updates, inventory and remote lock and wipe.
• Pick an ownership model deliberately; app-level protections can secure work data on personal phones without managing the whole device.
• When a device is lost, lock it, revoke sessions, reset passwords and wipe it, then record what data it held.
• Remote wipe is a backup, not a primary defense; encryption set up in advance is what protects a device you never recover.

Sources

• NIST, SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise (May 2023)
• Microsoft, App protection policies overview (Intune)
• Microsoft, Wipe devices with Microsoft Intune
• Apple, User Enrollment and device management (Apple Platform Deployment)
• Android Developers, Work profiles
• Microsoft, Revoke user access in an emergency in Microsoft Entra ID
• FTC, Data Breach Response: A Guide for Business