Allow a personally owned work device only after defining the functions and data it may access, checking that its required apps work and confirming support for the exact model and operating-system release throughout its intended use. Managed apps or a separate work profile can suit routine mobile work, but the National Cyber Security Centre warns that not every organisational function can be handled securely through bring your own device (BYOD); privileged work calls for a company-managed device or a separately assessed, stronger control model.
Staff using email, calendars, collaboration tools and approved mobile apps on personal phones or tablets need a way to separate work information from personal use. Microsoft, Apple and Android each document approaches with different management boundaries.
Teams relying on browser services, desktop applications, accessibility tools or file-based work need to test those tasks on the proposed laptop and operating-system release. They also need to check its update path for the planned period of use.
People administering company systems or handling higher-risk functions need a separate access decision. The National Cyber Security Centre cautions that BYOD cannot securely cover every organisational function, so a company-managed device or a specifically assessed stronger control model may be needed.
Define the permitted work and data access before assessing device support, management and application fit. The National Cyber Security Centre advises organisations to determine what BYOD will be used for because those functions affect risk.
| Concern | What to check | Who this matters to |
|---|---|---|
| Support life and updates | Check the exact model, planned operating-system release and edition, and whether manufacturer and software support cover the intended use period. | I need my work device to keep receiving required updates until I stop using it for work; around 33% of consumers put support life first. |
| Work-data separation | Test the required apps with the chosen app-protection, enrolment or work-profile method; establish what business information the organisation can manage or remove. | If I use my own phone, I need work information kept within the agreed managed space; around 27% of consumers prioritise data separation. |
| Applications and accessibility | Test essential apps, browser services, accessibility tools and authentication on the proposed device and operating-system version. | My work depends on particular software or accessibility tools, so a device that cannot run them will not meet my needs; around 20% of consumers put workflow fit first. |
| Privacy and practical adoption | Explain management boundaries to staff and check whether the permitted controls and support arrangements suit the work involved. | Before using my own device for work, I want to understand what my organisation can control; around 20% of consumers put privacy and practical acceptance first. |
A device can run today’s apps yet fall short of the planned work period. Microsoft ties Windows 11 support to the feature-update release and edition; Android device updates require model-specific checks.
Record the model, operating-system version or edition, planned end-of-use date and applicable support information before approving it. Recheck when a major upgrade is needed.
Support ending early can bring forward device replacement and migration.
The National Cyber Security Centre warns that organisations cannot securely perform every function using only BYOD and specifically cautions against giving BYOD users administrative access to company resources.
Set permitted and prohibited functions before selecting devices. Use a company-managed device or a separately assessed stronger control model for privileged work.
Microsoft app protection, Apple User Enrollment and Android work profiles manage different parts of a personal device. A phone running the required app is not, by that fact alone, ready for the intended work-data controls.
Test the required apps and information flows with the proposed method, then explain to staff what the organisation can manage, restrict or remove.
UK Government Security guidance addresses government organisations and their arm’s-length bodies using personally owned mobiles for limited, lower-risk corporate data at OFFICIAL classification. It does not establish a general permission for private-sector BYOD.
Assess the firm’s own functions, data and management capabilities rather than treating that policy as approval for a particular device or workflow.
Relevant to Windows-based work laptops and organisations considering Intune app protection for supported mobile apps.
Relevant to iPhone, iPad and Mac users where the organisation wants to manage work accounts and settings on personally owned devices.
Relevant to organisations considering Samsung Galaxy mobiles with Knox Suite and their chosen enterprise-mobility-management approach.
Relevant through Android Enterprise for organisations considering personal Android devices with managed work profiles.
Check the exact model, operating-system version and edition, current update status and manufacturer support information against the intended work period. Microsoft’s Windows 11 support lifecycle depends on the feature-update release and edition, while Android update information can be specific to the manufacturer and model.
Do not approve ordinary BYOD for privileged access by default. The National Cyber Security Centre warns against giving BYOD users administrative access to company resources; use a company-managed device or assess a stronger control model for that work.
No: a phone or tablet may suit defined tasks such as email and supported collaboration apps, but the decision must follow the actual work functions. Test any required desktop application, file workflow or accessibility tool before approving a mobile-only arrangement.
Choose a method that works with the required apps and acceptable management boundaries. Microsoft describes app-level protection without device enrolment, Apple offers User Enrollment for organisational accounts and information, and Android provides managed work profiles; these approaches do not grant identical control over the device.
Set rules for permitted data and work functions, device security, access removal and what happens when a device is lost or a worker leaves. The Information Commissioner’s Office advises keeping software updated, using strong passwords and minimising personal-data storage on the device; assess any additional legal or data-protection duties against the organisation’s circumstances.