Is your company ready to allow users to use their personal devices for work?

Your company is ready to allow personal devices for work only if it has three things: written rules that employees have accepted, secure access to company data, and a solution that can protect or wipe company data on personal devices without the company intruding on employees’ private lives.

IT, and technology in general, is a very dynamic field. It never stands still, and things can change from one week to the next.

Remote work has popularized a trend that specialists call BYOD (bring your own device). This means users can use their personal devices (usually laptops, computers and mobile phones) to do their work.

As company infrastructures are increasingly ready for working from home or from anywhere, and cloud technologies offer all kinds of collaboration features, BYOD stopped being just a whim a long time ago. Today, BYOD most often means the personal phone on which an employee reads work email and joins Teams.

How should companies prepare for BYOD?

Companies that want to allow BYOD need to:

• invest in a UTM firewall that allows VPN accounts to be configured and provides security features for the entire infrastructure;
• configure their file and application servers so they’re accessible through the VPN tunnel, with two-step verification;
• increase the security of the entire infrastructure;
• implement a solid backup policy, for example through Backup as a Service;
• use a device management (MDM) solution, such as Microsoft Intune, which checks whether a device complies with company rules before allowing it access to data.

For cloud applications (Microsoft 365, Google Workspace), the basic rule is to allow access only from devices that meet the company’s requirements: an up-to-date operating system, a screen locked with a PIN or password, and data encryption.

What should a BYOD policy contain?

A good BYOD policy is short and clear, and it states:

• which devices are accepted and their minimum requirements: an operating system that still receives security updates, PIN or biometric lock, encryption;
• which data and applications personal devices can access, and which they can’t;
• what the company can see and do on the device: as a rule, only work data and apps, not personal photos, messages or history;
• what happens when the device is lost or when the employee leaves the company: company data is wiped remotely and the accounts are closed;
• who pays any costs, such as the phone plan or repairs.

Because a personal device also holds personal data, the policy must comply with the GDPR, and employees must know exactly what is being monitored.

How do you separate company data from personal data?

Company data is separated from personal data through device management solutions:

• on phones, the work profile on Android and User Enrollment on iPhone keep company apps and data separate from personal ones;
• app protection policies prevent, for example, copying a document from Outlook into a personal app;
• selective wipe remotely removes only company data from a lost phone or from the device of someone who has left;
• virtual desktops (for example Windows 365 or Azure Virtual Desktop) keep the data on the company’s servers: only the access window runs on the personal laptop.

What should you check on a personal device before using it for work?

Before employees use their personal devices for company work, a thorough maintenance session is worth doing. In short, you need to check the following:

• the operating system: Windows 10, for example, hasn’t received free security updates since October 14, 2025, so a personal laptop running Windows 10 either moves to Windows 11 or gets no access to company data;
• a virus scan and removal of any threats found;
• hardware maintenance;
• fixing software errors;
• installing the applications needed for day-to-day work;
• optimizing the workstation so applications run smoothly;
• installing a centrally managed security solution;
• a backup policy for the work data on the workstations.

Here’s why all these checks are necessary.

An inexperienced user may install free apps from the internet that can be infected with adware, spyware or other types of malware. A thorough virus cleanup is a must before accessing company data from a personal device.

Personal laptops usually aren’t inspected and cleaned on the hardware side, so they can run hotter than they should. We recommend cleaning the dust out of laptops and computers and replacing the thermal paste, to prevent certain problems and extend their lifespan. More about computer repair.

Fixing software errors makes the applications needed for office work run faster. Quite often, users don’t completely uninstall apps they no longer need, and these use up resources for nothing.

Once the steps above are done, the workstation is ready for installing and running the applications needed for the job. A software optimization is also recommended after all the applications are installed.

Since these devices handle company data, it’s absolutely mandatory for the workstations to be protected by a security solution managed and monitored by the IT team.

A solid backup policy is also necessary, so that company data isn’t lost or compromised in any way.

When is BYOD not worth it?

BYOD isn’t worth it when the company works with highly sensitive data, or when an incident would cost more than a work laptop. For companies that fall under the NIS2 Directive (in Romania, GEO 155/2024) or that work with medical or financial data, it’s usually simpler and safer for the equipment to belong to the company and be fully managed by the IT team.

RezolvIT is a managed IT services company in Bucharest that provides personalized IT support to businesses. We propose and implement technical solutions for working both at the office and from home, and we prepare computers and accounts for new employees and close access for those who leave. More about IT security; we start with a free IT audit.