BYOD Policy for Small Business: A Copyable Outline

A BYOD (bring your own device) policy is a short written agreement that says which personal phones, tablets, and computers may reach company email and files, what security they must have, what the business can and cannot see on them, and how company data is removed when someone leaves. For most small offices it runs two to three pages, is signed by each employee, and is enforced with app-level protection instead of taking control of the whole phone. California employers also need to address reimbursement.

What should a BYOD policy cover?

Ten things, each of which maps to a section in the outline below: scope, eligible devices, security requirements, approved apps, what the company can see, lost device reporting, departure, reimbursement, support limits, and acknowledgment.

NIST, the federal standards agency, publishes detailed guidance in SP 800-124 Revision 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise, and a worked example in SP 1800-22, Mobile Device Security: Bring Your Own Device. Both are written for larger organizations. The outline below applies the same ideas at small office scale.

A BYOD policy outline you can copy

Replace the bracketed parts. Keep the language plain enough that staff will read it.

1. Purpose and scope

“This policy applies to any personally owned phone, tablet, or computer used to access [Company] email, files, or business applications. It applies to employees and to contractors who are given a company account.”

2. Eligible devices

“Devices must run an operating system version that still receives security updates from its maker. Devices that have been jailbroken or rooted (modified to remove built-in protections) may not be used.”

3. Required security settings

“Each device must have: a passcode or biometric lock, automatic screen lock after [5] minutes, device encryption turned on, and automatic operating system updates turned on.”

4. Approved apps and data

“Company email, calendar, and files are accessed only through [Outlook, Teams, OneDrive, and other named apps]. Company files are not saved to personal cloud storage, personal email, or the device’s general storage. Personal computers may access company data through [the web browser only / approved apps only].“

5. What the company manages and what it can see

“The company manages only the work apps and the data inside them. The company does not view personal photos, messages, browsing history, or personal apps, and does not track the location of personal devices.” Adjust this to match your actual tool. See the privacy section below.

6. Lost, stolen, or replaced devices

“Report a lost or stolen device to [name or role] within [24 hours]. The company will remove work data from the device remotely. Tell us before you sell, trade in, or give away a device that has had company data on it.”

7. When you leave

“On or before your last day, the company removes work apps’ company data and your account’s access. Personal content is not affected.”

8. Reimbursement

“The company reimburses [amount or percentage] per month for required business use of a personal phone.” California employers should read the section on Labor Code 2802 below before writing this one.

9. Support and responsibility

“The company supports the work apps. Repairs, carrier issues, and personal apps remain the employee’s responsibility. The company is not responsible for personal data; keep your own backup.”

10. Acknowledgment

A signature and date line stating the employee has read the policy, agrees to it, and understands that access may be removed if a device does not meet it.

What can the business see on a personal device?

This is the question staff care about most, so answer it precisely. The answer depends on the tool and mode you use.

If you use Microsoft Intune, Microsoft publishes the list. Even on a fully enrolled device, an organization can never see calling and web browsing history, email and text messages, contacts, calendar, passwords, photos, or the content of documents. It can always see the device model, manufacturer, serial number, operating system version, and device name. On personal devices it sees only the inventory of managed work apps, and Microsoft states that an organization cannot view a personal device’s location.

With app protection only (next section), the device is not enrolled at all, so the business has even less visibility: it manages the work apps and nothing else.

Give staff the vendor’s own page. It carries more weight than a summary, and it keeps the policy honest if the vendor changes what is collected.

How does app protection work without enrolling the phone?

Full mobile device management (MDM) enrolls the device and manages all of it. For personal phones that is usually more control than the business needs or the employee wants. The alternative is mobile application management (MAM): rules that apply inside the work apps only. We compare the two in our mobile device management guide.

In Microsoft 365, this is done with Intune app protection policies, which Microsoft says can protect company data “for devices without enrollment.” A policy can:

• Require a PIN or fingerprint to open Outlook, Teams, or OneDrive with the work account
• Prevent copying and pasting company data into personal apps
• Block saving company files to personal storage locations
• Block managed apps from running on jailbroken or rooted devices
• Encrypt the work data held by the app
• Remove the work data from those apps remotely (a selective wipe) while leaving personal content alone

Microsoft publishes three recommended levels of settings. Level 1, the entry level, requires an app PIN, encrypts work data, and allows selective wipe. That is a sensible starting point for a small office.

Policies are created in the Intune admin center under Apps > Protection. To make the policy stick, pair it with a Conditional Access rule that grants access only with “Require app protection policy”. Without that rule, someone could add the work account to an unprotected mail app and bypass everything.

Licensing: app protection needs Intune, which is included in Microsoft 365 Business Premium or available as a standalone add-on. See our Microsoft Intune guide for plans and prices. Android also offers a work profile, a separate managed space on a personal phone, which does require enrollment but keeps work and personal sides apart.

California considerations: Labor Code 2802

This section is general information, not legal advice. Confirm your approach with an employment attorney.

California Labor Code section 2802 requires an employer to “indemnify his or her employee for all necessary expenditures or losses incurred by the employee in direct consequence of the discharge of his or her duties.” The state Labor Commissioner’s office summarizes it as a right to be reimbursed for expenses incurred as a direct consequence of work duties.

For personal phones, the key case is Cochran v. Schwan’s Home Service, decided by the California Court of Appeal in 2014. The court held that when employees must use personal cell phones for work, the employer owes reimbursement of “a reasonable percentage of their cell phone bills”, whether the employee has a limited or an unlimited plan. The fact that the employee would have paid the same bill anyway is not a defense.

What this means for the policy:

• If work use of a personal phone is required, include a reimbursement term. The court did not set a formula. One option is a fixed monthly amount stated in the policy and reviewed periodically so it stays reasonable.
• If work use is truly optional and you provide another way to do the job (a company phone or a desk computer), say so in writing. Whether use is optional in practice is a question for counsel.
• Section 2802(c) includes attorney’s fees in what an employee can recover, so a small monthly amount is inexpensive compared with a dispute.
• Hourly employees answering work messages on a personal phone outside their shift raises separate wage and hour questions. Ask your attorney how the policy should address after-hours use.

When is BYOD the wrong answer?

Personal devices are not always the cheaper or simpler choice. Consider company-owned devices when:

• A role handles regulated data every day, such as patient records under HIPAA. Full management of a company device is easier to defend than partial control of a personal one.
• You would need to fully enroll the device to meet a requirement. At that point the employee gives up privacy on a device they paid for.
• The reimbursement you owe approaches the cost of a basic company phone plan.
• A device is shared among several staff.

A mixed approach is common: company laptops for everyone, personal phones with app protection for email and Teams.

Common mistakes

• Writing a policy with no technical enforcement behind it, or enforcement with no written policy.
• Promising staff “we cannot see anything” when the tool does show device model and work app inventory. Be exact.
• Fully enrolling personal phones when app protection would meet the need.
• Leaving reimbursement out of a California policy.
• Forgetting personal computers. A home PC that syncs the whole company OneDrive holds far more data than a phone.
• Not removing work data at departure because nobody recorded which personal devices had access. Add it to your offboarding checklist.

Common questions

Can an employer wipe an employee’s personal phone?

With app protection or a retire action, the business removes only work data and leaves personal content in place. A full factory reset is technically possible only on a fully enrolled device, and it is rarely appropriate for a personal one. State in the policy that only work data will be removed, and configure the tool to match.

Do we need a BYOD policy if staff only check email on their phones?

Yes, a short one. Email usually contains the most sensitive information a small business has, including attachments, customer details, and password reset links. A one page version covering device lock, approved mail app, lost device reporting, and departure is enough for email-only use.

Does a California employer have to reimburse personal phone use?

If the employee is required to use a personal phone for work, yes. Labor Code section 2802 and the Cochran decision call for reimbursing a reasonable percentage of the bill, even on an unlimited plan. The exact amount and how to handle optional use are questions for an employment attorney.

Can an employee refuse to put work apps on a personal phone?

They can, and the policy should say what happens then. The usual answer is that the business provides another way to do the job, such as a company phone or access from a work computer only. Requiring personal phone use strengthens the reimbursement obligation in California.

How Coastal Growth Co. can help

We help small businesses in Orange County turn this outline into a working setup: adapting the policy to how your staff really work, configuring Intune app protection and the matching Conditional Access rule, and testing a selective wipe before it is needed. We handle the technical side and leave the employment law questions to your attorney. Scope and price are agreed before paid work begins. See our managed IT services or contact us.