Policy
Bring Your Own Device (BYOD) Policy
This policy governs the use of personally owned devices, including smartphones, tablets, and laptops, to access corporate data and applications. It defines the technical controls applied to personal devices, the obligations of the device owner, and the boundaries of the organization's access to the device.
- Type
- Policy
- Version
- 1.5.0
- Date
- 2026-10-16
- Owner
- Chief Information Security Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Information Security
- Review frequency
- Annual and upon material platform, regulatory, or organizational change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose
- 2. BYOD deployment models
- 3. Scope
- 4. Governance and accountability
- 5. Approved access model
- 6. What the organization does not do
- 7. Data classification restriction
- 8. Acceptable use on personal devices
- 9. Incident and loss reporting
- 10. Termination and offboarding
- 11. Policy violations
- 12. Exceptions
- 13. Framework alignment
Frameworks it maps to
- ISO/IEC 27001:2022
- NIST SP 800-124r2
- CSA CCM v4.1
- NIST SP 800-63B-4
- NIST SP 800-46 Rev. 2
- NIST SP 800-53 Rev. 5
- NIST SP 800-171 Rev. 3
- ISO/IEC 27002:2022
- ISO/IEC 27032:2023
- ISO/IEC 29151:2026
- CIS Controls v8
- HITRUST CSF v11.8.0
- CISA Zero Trust Maturity Model v2.0 (April 2023)
- Canada CCCS Baseline Cyber Security Controls for Small and Medium Organizations V1.2
- ILO Code of Practice on the Protection of Workers' Personal Data (1997)
- Article 29 Working Party Opinion 2/2017 on data processing at work (WP 249)
- UK ICO, Employment practices and data protection: Monitoring workers (June 2024)
- Commission Delegated Regulation (EU) 2024/1774 (DORA RTS on the ICT risk management framework)
- FFIEC IT Examination Handbook, Architecture, Infrastructure, and Operations (June 2021)
- FFIEC IT Examination Handbook, Information Security (September 2016)
- Australian Information Security Manual (June 2025)
- Saudi Arabia Essential Cybersecurity Controls (ECC-2:2024)
Related documents
- Acceptable Use Policysecurity
- Authentication and Password Management Standardsecurity
- Remote Working Security Standardsecurity
- Data Classification and Handling Standardsecurity
- IT Onboarding and Offboarding Proceduresecurity
Next
All Documents