Bring Your Own Device (BYOD) policies are here to stay. The flexibility, familiarity, and increased productivity that personal devices provide has forced companies to adapt to this workplace revolution in a hurry. Yet many companies are still struggling to strike the right balance between personal freedom and corporate responsibility. In part one of our two-part article, we'll detail a six-step plan for developing the strategy and policy necessary to manage BYOD effectively.
Gather Your Team
Don't go this alone. As you begin making a detailed plan for allowing the use of personal devices, get your employees involved, and keep in mind, the more the merrier. You want as much feedback, input, and honesty as you can handle. Taking the time to wade through everyone's concerns is the best way to get the full picture. You need to determine how much freedom your employees are expecting, what your IT department can handle, and any concerns your legal department might have so everyone has raised red flags before issues arise. Remember, there is no one-size-fits-all approach to creating a BYOD policy so you'll need to restructure your management style to fit the employees you have, the systems you use, and the regulatory requirements your company must meet. The goal is to create a strategy that doesn't compromise data security yet still satisfies your employees.
Think Long Term
The goal of your company is to grow, so when developing a BYOD policy, don't be reactive, be proactive. Ensure that, as you design your solutions, they can support a greater number of devices or users when needed. Make sure your policies won't need to be rewritten every time a new sub-contractor is hired, or a new technology emerges. Today your employees have cell phones and tablets, in a few years (or months) they might be keen on wearables or smart desks. Ideally, you want to be endpoint independent in your approach so you can quickly adapt to innovative new devices and emerging platforms.
Assess Risk and Assign Access
Now that you have an overview, it's time to decide the details of how you'll protect your sensitive data.
Start by deciding which devices are acceptable within your company. You'll accomplish this by weighing a combination of factors including what devices or apps your employees are already using (another great reason to check in with your staff before designing your policies), and which types can be easily monitored going forward. Create a list of acceptable devices and applications and be specific. A "choose your own device" model where employees select from a list of acceptable devices can help bridge the gap between secure options and personal preference.
Also, decide what sets of data you'll allow to be transmitted on BYOD devices. An effective way of doing this is by adopting the principle of least privilege. This principle restricts access so users can only use the exact data and software required to do their job. In addition, implement multi-factor authentication to make sure you’re putting as many barriers between hackers and your company data as possible.
If you feel you need assistance from top-level experts, contracting a Managed Service Provider (MSP) can also help. Using an MSP like Capstone Works simplifies the process by having dedicated IT experts who can quickly assess your situation and create customized BYOD policies for your business. Contact Capstone Works today to learn more about how we can help.
