BYOD policy for small teams: personal devices, company data, one page of rules

The one page that ends the quietest data leak in a small team: work files living on personal phones and laptops with no rule, no boundary, and no exit.

Friday, 5:40. A designer photographs a whiteboard full of client material on her personal phone, edits the render on her own laptop over café wi-fi, and emails the draft from personal Gmail because the company one is signed out on her phone. Nobody did anything malicious — and the client files now live on two machines nobody can wipe, inside a cloud drive the company has never seen, behind an inbox that will still work after she resigns.

That is what happens without a BYOD policy. The fix is not buying everyone a second phone. It is one page that says which personal devices may touch company data, what the company sees and wipes in exchange, and the five things any such device must have before the first sync.

The device list, decided before anyone asks

• Phones: yes — mail, calendar, chat, and the MFA app live there anyway. A proper work profile beats the alternative, which is someone re-adding work mail through a browser and calling it a day.
• Personal laptops: usually no for client data. A full desktop with a personal browser, personal cloud sync, family logins, and unknown disk state. Company work happens on a company machine; personal laptops get read-only exceptions, written down or they're not exceptions.
• Old tablets and the spare phone in the drawer: the yes needs a date, and eligibility ends when OS updates end — not when the policy gets annoyed.

The trade, stated in one honest sentence

A work profile — the managed apps on iOS, the work container on Android — is what the company can see and wipe. It reaches nowhere else. Say it plainly, because the rumor version ("IT can see my photos") is what kills BYOD enrollment at the dinner-table conversation.

The wipe has a boundary, and everyone should know it: removing the work container deletes work mail, work files, and the MFA enrollment. It does not touch the camera roll. When a person leaves, that's the difference between offboarding and confiscation.

Five non-negotiables, checked before the first sync

1. Biometric or six-digit screen lock, auto-lock at two minutes.
2. OS updates within 30 days — checked by the same console report the patch program already runs.
3. Disk encryption, verified — modern phones yes; personal laptops are where FileVault/BitLocker "verified" earns its keep.
4. The MFA app enrolled to the company's MFA rollout — and if the authenticator dies with the phone, the lost-device runbook starts the same hour.
5. No jailbroken or rooted devices. A removed security model is not "personalization"; it's a compromised terminal asking to hold your session tokens.

Where company data may and may not live

The shadow perimeter isn't a hacker — it's the slide deck exported to personal iCloud "to finish tonight." One policy sentence covers it: company files sync through company accounts. The habit that makes the sentence true is making the managed sync client pleasant to use, because a tool that's annoying gets routed around. Same physics as permissions audits: access people can't reach gets recreated in the dark.

The exit: revoke first, wipe second

Sessions and tokens die in the admin console the hour notice is given. Then the container wipe removes the work space — and the person's photos, apps, and life remain untouched. Offboarding that respects the container gets forgotten by Tuesday; offboarding that feels like confiscation gets named in the group chat. One of those is cheaper.

A lost personal device runs the same containment: report in hours, revoke sessions, wipe the container, re-enroll. The one twist: the company never tracks personal devices. Find My belongs to the owner; the company's job is assuming it's gone from minute one.

The done-signals

• Every personal device holding company data is enrolled or explicitly exception-listed.
• A new phone is productive in twenty minutes without IT touching it.
• A leaver's phone is work-clean the same day, camera roll intact.
• Nobody can name a client file in a personal cloud drive.

Full checklist with the data-boundary details, the account-separation architecture, and the review hooks:

→ BYOD Policy Checklist for Small Teams — ops-notes

More free ops notes for small teams: ops-notes index · And when you're ready to go deeper: the Ops Starter Kit ($14) and Agent Ops 24/7 ($19) on Gumroad.