Personal devices at work: a bring-your-own-device (BYOD) kit.
If anyone reads work email on a personal phone, you already have a BYOD program; the question is whether it has rules. This kit gives you a plain-English policy, a minimum security bar, and an honest privacy promise to your staff.
1. Pick a model
Company-owned only
Simplest to secure and to wipe. Costs more, and staff carry two phones.
Personal devices with separation
Staff use their own devices, but work apps and data live in a separate, managed space. The most common choice for small businesses.
Company-owned, personal use allowed
The business owns the device and allows reasonable personal use. Make clear that the device can be fully erased.
2. Set a minimum security bar
Any device that touches company email or data must have:
- A supported operating system with automatic updates turned on
- A screen lock (6-digit PIN or longer, or biometrics) and encryption turned on
- No jailbroken or rooted devices
- Apps only from official app stores
- Multi-factor authentication on every work account
- Work data only in approved work apps or the work profile, never in personal cloud storage
- Report a lost or stolen device to the business the same day
3. Keep work and personal apart
- Android: Use an Android work profile, which keeps work apps and data in a separate, managed container.
- iPhone and iPad: Use Apple's account-driven User Enrollment with a Managed Apple Account, which separates work data from personal data.
- Laptops: Use separate browser profiles, and access company files through the company's cloud apps rather than downloading them.
- Messaging: Use the company's chat or email for client communication, not personal text messages or social apps.
4. Make an honest privacy promise to your staff
People accept security rules on their own phones when they know exactly what the business can and cannot see. With a work profile or managed account in place:
The business can see
- Device model and operating system version
- Whether a passcode and encryption are turned on
- Work apps, work email, and work files
- Whether the device meets the minimum security bar
The business cannot see
- Personal photos, messages, and email
- Personal browsing history
- Personal apps and their data
- Your location, unless this is separately disclosed and agreed to in writing
5. Plan for departures
- Remove the work profile or managed account (a selective wipe), not the whole device
- Revoke access and sign out all work sessions the same day
- Return or transfer any work files the person created
- A full erase of a personal device happens only if the employee agreed to it in writing beforehand
6. Decide who pays
Common approaches are a monthly phone stipend, reimbursing a share of the plan, or providing company devices to roles that handle the most sensitive data. Put the choice in writing and apply it consistently, and check state rules on reimbursing employees' business expenses.
The template includes an employee acknowledgment and privacy notice. It is a starting point, not legal advice; have it reviewed for your state and industry, especially if you handle health, payment, or defense data.
Sources and further reading: NIST SP 800-46 Rev. 2: Telework, Remote Access, and BYOD Security · NIST SP 800-124 Rev. 2: Managing the Security of Mobile Devices · NIST SP 800-114 Rev. 1: User's Guide to Telework and BYOD Security
Laptop security checklist.
A lost or infected laptop is one of the most common ways small-business data leaks. Every item below uses settings already built into Windows and macOS.
Updates and protection
- Turn on automatic updates for the operating system, browser, and apps; restart when prompted
- Keep built-in protection on: Microsoft Defender on Windows, XProtect and Gatekeeper on Mac
- Turn on the built-in firewall (Windows Security, or System Settings > Network > Firewall on Mac)
- Remove software you no longer use, and replace a laptop that no longer receives security updates
Encryption and sign-in
- Turn on full-disk encryption: BitLocker or Device Encryption on Windows, FileVault on Mac
- Store the encryption recovery key somewhere safe, such as your password manager, not on the laptop
- Use a strong password or passphrase, plus Windows Hello or Touch ID for convenience
- Use a standard (non-administrator) account day to day; keep a separate admin account for installs
- Lock the screen automatically after 5 minutes or less, and lock it whenever you step away
Browsing and accounts
- Use a password manager and turn on multi-factor authentication (MFA) for email, banking, and work apps
- Keep separate browser profiles for work and personal use
- Install only a few browser extensions you trust; remove the rest
- Do not save company files in personal cloud storage or personal email
Backup and recovery
- Follow the 3-2-1 rule: 3 copies, on 2 different types of storage, 1 offline or off-site
- Test a restore at least twice a year
- Turn on Find My Device (Windows) or Find My (Mac) so a lost laptop can be located, locked, or erased
- Never leave the laptop visible in a car, and use a privacy screen when working in public
Sources and further reading: CISA: Secure Our World · NIST SP 800-114 Rev. 1: User's Guide to Telework and BYOD Security
Phone lockdown guide.
Your phone holds your email, banking, authenticator codes, and often your company's data. Thieves and scammers increasingly target the phone number itself to take over accounts.
Every phone
- Use a 6-digit or longer passcode plus Face ID or fingerprint; set auto-lock to 1 minute
- Turn on automatic updates, and replace a phone that no longer receives security updates
- Install apps only from the official App Store or Google Play; delete apps you no longer use
- Review app permissions for location, microphone, camera, contacts, and photos; choose 'only while using'
- Hide message previews on the lock screen so codes and private texts are not visible
- Restart your phone at least once a week, as the NSA recommends, to clear some types of malware
- Set AirDrop and Nearby Share to Contacts Only, and turn off Bluetooth when you are not using it
Protect your phone number (SIM-swap fraud)
- Ask your carrier to add an account PIN or passcode and turn on number lock or port-out protection
- Set a SIM PIN, so a stolen SIM card cannot be used in another phone
- Use passkeys or an authenticator app instead of text-message codes for email, banking, and work accounts
- If your phone suddenly loses service for no reason, call your carrier immediately from another phone
iPhone
- Turn on Stolen Device Protection (Settings > Face ID & Passcode)
- Keep Find My iPhone on, and use Safety Check to review who has access to your location and accounts
- Consider Lockdown Mode if you are a likely target, such as an executive, journalist, or official
- Consider Advanced Data Protection for end-to-end encrypted iCloud backups
Android
- Keep Google Play Protect on, and use Find Hub (formerly Find My Device)
- Turn on Theft Detection Lock and Offline Device Lock in theft protection settings
- On Android 16 or later, consider Advanced Protection for the strongest built-in security
- Run the Google Security Checkup on your Google account
Sources and further reading: NSA: Mobile Device Best Practices and telework guidance · Apple: About Lockdown Mode · Google Security Checkup
Home office and home network checklist.
When you work from home, your router protects your company. Most home routers are still running factory settings, and every smart device on the same network is a way in.
Router
- Change the router's default admin password to a long, unique passphrase
- Turn on automatic firmware updates, and replace a router that no longer receives updates
- Use WPA3 encryption (or WPA2-AES if WPA3 is not available) with a strong Wi-Fi passphrase
- Turn off remote administration, WPS, and Universal Plug and Play (UPnP) unless you need them
- Consider protective DNS that blocks known malicious sites, such as Quad9 or Cloudflare 1.1.1.2
Separate what you can
- Put visitors, smart TVs, cameras, speakers, and other smart devices on a guest network
- Keep work laptops off the network that children's gaming devices use, if your router supports it
- Change default passwords on printers, cameras, and other connected devices, and keep them updated
Workspace habits
- Lock your screen whenever you leave your desk, even at home
- Keep smart speakers away from where you take confidential calls
- Shred printed client or employee information instead of putting it in household trash
- Use your phone's hotspot instead of public Wi-Fi for sensitive work when traveling
Sources and further reading: NSA: Best Practices for Securing Your Home Network (PDF) · CISA: Secure Our World
Personal privacy and identity protection kit.
Criminals use exposed personal details to open credit in your name, file fake tax returns, and craft convincing scams against you and your business. These steps are free and take an afternoon.
Lock your identity
- Freeze your credit at Equifax, Experian, and TransUnion; it is free and you can lift it temporarily when you apply for credit
- Consider freezing your children's credit as well
- Get an IRS Identity Protection PIN to stop someone else from filing a tax return in your name
- Create your own my Social Security account before someone else does
- Turn on transaction alerts for every bank and credit card account
Shrink your exposure
- Sign up for free breach alerts at Have I Been Pwned for each email address you use
- Use Google's Results about you tool to request removal of search results showing your phone number or home address
- Opt out of the largest people-search sites; California residents can use the state's DROP platform to reach every registered data broker at once
- Set social media accounts to private, and remove birthdays, pet names, schools, and travel plans from public view
- Use email aliases (such as Hide My Email, Firefox Relay, or SimpleLogin) for shopping and newsletters
Separate personal and business
- Use separate email accounts, phone numbers, bank accounts, and cards for personal and business use
- Use a business phone number (for example, a VoIP number) on websites, invoices, and listings instead of your personal cell
- Keep business files in business-owned storage, not personal cloud accounts
- List a business address or mailbox instead of your home address wherever possible
Sources and further reading: FTC: Credit freezes and fraud alerts · IRS: Get an Identity Protection PIN · Have I Been Pwned · Google: Results about you · California Privacy Protection Agency (DROP)
Digital protection for owners and executives.
Owners, finance staff, and executives are the people attackers impersonate and target first. A few rules stop the most expensive scams, including business email compromise and AI voice cloning.
Stop payment fraud
- Never change bank or payment details based on an email, text, or call alone; call back on a number you already have
- Require two people to approve new payees, bank changes, and large or urgent payments
- Agree on a code word with family and key staff to verify urgent requests, since voices and video can now be faked with AI
- Treat urgency, secrecy, and gift-card requests as red flags, especially when they appear to come from you
Harden the accounts that matter most
- Use phishing-resistant MFA (passkeys or security keys) on email, banking, payroll, and your domain registrar
- Keep account recovery email addresses and phone numbers current, and store recovery codes offline
- Use delegated access for assistants instead of sharing your password
- Use separate administrator accounts for IT changes, not your everyday email login
Reduce what attackers can learn
- Search for yourself and your company: note exposed emails, org charts, home address, and family details
- Limit public staff directories with direct emails and reporting lines; use role addresses such as info@
- Be careful what you post about travel while you are away
Travel
- Bring only the devices you need; consider a loaner laptop and phone for high-risk travel
- Use your own charger and a wall outlet rather than public USB charging ports
- Use your phone's hotspot instead of hotel or airport Wi-Fi for sensitive work
- Update and fully back up devices before you leave
Sources and further reading: Nexus: Deepfake and voice-clone verification checklist (PDF) · Nexus: Spotting AI fakes · FBI Internet Crime Complaint Center (IC3)
Lost a device or think you've been hacked? Your first hour.
Speed matters more than perfection. Print this card and keep it somewhere you can reach without the device you are worried about.
Lost or stolen phone or laptop
- From another device, use Find My (Apple) or Find Hub (Android) or Find My Device (Windows) to locate it, lock it, and mark it lost
- Call your carrier to suspend the line and block a SIM swap
- Tell your employer or IT contact right away if the device had any work email, apps, or files
- Change the passwords for your email, banking, and password manager, and sign out of all sessions
- If you cannot recover it, erase it remotely
- File a police report if it was stolen; insurers and employers often require one
- Watch bank, credit card, and account alerts closely for the next few weeks
Hacked account
- From a device you trust, change the password and sign out of all other sessions
- Check that multi-factor authentication, recovery email, and recovery phone have not been changed
- In email accounts, delete forwarding rules and filters you did not create
- Change the same password anywhere else you reused it
- Warn your contacts not to act on unusual messages from you
- If money was sent or stolen, call your bank immediately, then report it to the FBI at ic3.gov and to the FTC at ReportFraud.ftc.gov
- If your identity was stolen, get a recovery plan at IdentityTheft.gov
- If business systems or client data may be involved, do not wipe anything; preserve evidence and call your incident response contact
Sources and further reading: FBI Internet Crime Complaint Center (IC3) · FTC: Report fraud · FTC: IdentityTheft.gov · Nexus: Incident response first 24 hours checklist (PDF)
Score your mixed-use risk, then list the accounts to secure.
Both tools run entirely in your browser. Nothing you enter is sent to us or saved anywhere; it disappears when you close the page.
Personal and business mixed-use self-assessment
Accounts-to-secure worksheet
List the accounts that would hurt most if someone took them over: email, banking, payroll, domain registrar, cloud storage, social media, and your phone carrier. Record where each one stands, then fix the gaps.
| Account or service | Used for | MFA type | In password manager? | Recovery email / phone current? | Notes | Remove |
|---|
Never enter passwords, recovery codes, or account numbers in this worksheet.
Trusted free sources to share with staff and family.
Independent, no-cost guidance from government agencies and nonprofit organizations.
CISA: Secure Our World
Plain-language basics from the U.S. Cybersecurity and Infrastructure Security Agency.
FTC consumer advice
Scams, identity theft, and privacy guidance from the Federal Trade Commission.
EFF Surveillance Self-Defense
Step-by-step privacy and security guides from the Electronic Frontier Foundation.
Consumer Reports Security Planner
Personalized, free security recommendations in a few minutes.
National Cybersecurity Alliance
Tips and awareness material you can share with staff and family.
Google Security Checkup
Review sign-ins, devices, and recovery options for a Google account.
Apple Personal Safety User Guide
Safety Check, sharing controls, and device security for Apple users.
Want this set up across your team?
Nexus Security Advisors helps small and mid-sized businesses write a BYOD policy that staff will accept, configure work profiles and managed accounts, protect owners and finance staff from payment fraud, and train teams in plain English.