Every business
Should staff use personal laptops and phones for work?
· PS ProTech · 3 min read
Your associate reads work email on their own phone. Your bookkeeper logs in from the family laptop on Fridays. Nobody decided this; it just happened.
It doesn't have to stop. It does need rules, because right now your client files are on devices you know nothing about.
What can go wrong
The device is lost or stolen. If it isn't encrypted and locked, whoever finds it has your email and whatever was downloaded. See what to do in the first hour after a work laptop is lost or stolen.
Someone else uses it. A family laptop is shared with children, their games, and whatever those games installed.
It's out of date. Nobody at your firm checks whether a personal computer has installed its security updates. See why updates matter.
The person leaves. Their phone still has your email on it, and the files they saved stay where they are. Our offboarding checklist assumes you can remove access. On a device you don't manage, you can't.
You can't answer the question. Insurers and clients ask whether devices that access firm data are encrypted and protected. For personal devices, the honest answer is "we don't know."
Phones and computers are different problems
Phones are manageable. Modern phones are encrypted when locked, and Microsoft 365 and Google Workspace can keep work email and files inside managed apps. The firm can require a passcode for those apps and wipe just the work data when someone leaves, without touching their photos.
Personal computers are harder. A home computer runs whatever its owner installed, and files download straight to it. This is where firms get hurt.
A sensible policy
Phones: allowed, on conditions.
- A passcode and automatic lock
- Work email and files only through the managed apps
- The firm can remove work data from the phone
- A lost phone is reported the same day
Personal computers: not for client files. Choose one of these instead:
- Give people a firm laptop. It costs less than it sounds against the alternative.
- Browser only. If someone must use a home computer, they work in the browser, and downloading is blocked for unmanaged devices.
Never, on any device: firm passwords saved in a personal browser, or client files in a personal cloud account.
Put it on one page, have everyone sign it, and tell people why. Most staff are relieved to have a clear rule.
The settings that make the policy real
A rule nobody enforces lasts until the first busy week. These back it up:
- Sign-in rules that tell a firm device from a personal one, and allow less on the second. This needs the right license; see Microsoft 365 Standard or Premium.
- Managed apps on phones, with the ability to wipe work data.
- Monitoring and updates on every firm computer. See device monitoring and patching.
What it costs, against what it risks
| What it comes to | |
|---|---|
| A firm laptop | A one-time purchase, spread over four or five years |
| Having every firm computer monitored, updated and protected: our Essentials plan | $99 per person per month |
| A stolen personal laptop with client files on it | Possibly a data breach, with a 30-day duty to notify the people affected |
| A leaver who keeps a copy | A conversation you can't win, because you never controlled the device |
Buying laptops feels like an expense you could avoid. It's really the price of being able to say, to a client or an insurer, that you know where their information is.
Where to start
- Ask. Find out who uses a personal device for what. No blame.
- Sort out phones first. It's the quick win.
- Replace the personal computers that touch client files.
- Write the one-page policy and get it signed.
If you'd like help working out what's connected today, book a free Security Check.
