Mobile Device Security: An Enterprise Policy That Protects Without Spying
A mobile security policy that employees accept is one that protects corporate data without reading their personal messages. Here is how to write one.
Mobile devices are where employees do their most sensitive work — email, messaging, document editing, and authentication — and they are the endpoint most likely to be lost, stolen, or used on unsecured networks. Yet mobile security is frequently either ignored (because it is hard) or over-controlled (because it is easy to mandate MDM and read everything).
The policies that work protect corporate data without invading personal privacy, and they are built on a specific distinction: device management versus application management.
MDM vs MAM: the decision that shapes everything
| Approach | What it controls | Best for | Employee perception |
|---|---|---|---|
| MDM (Device Management) | Entire device — passcode, encryption, apps, restrictions | Corporate-owned devices | Acceptable; they know it is company property |
| MAM (Application Management) | Specific corporate apps and their data | BYOD | Acceptable; personal use is untouched |
| Containerisation | A secure container on the device for corporate data | BYOD with full email/app access | Best; corporate data is protected, personal data is private |
The minimum security baseline
- Passcode required. Minimum 6 digits or biometric. No passcode, no corporate data.
- Encryption enabled. Full-device encryption on corporate-owned; container encryption on BYOD.
- Remote wipe capability. Corporate data must be wipeable without touching personal data on BYOD devices.
- OS version enforcement. Devices below the current major version minus one should be blocked from corporate data — unpatched OS versions are a known risk.
- App allow-listing for corporate containers. Only approved apps can open corporate documents, preventing data leakage to unmanaged apps.
The BYOD policy that employees accept
The policy that works is one an employee reads and thinks "that seems fair." The policy that fails is one that reads "we can read your personal messages." The difference is containerisation: corporate data lives in a managed container that you can wipe, and personal data lives outside it where you have no access.
State this explicitly in the policy. Tell employees what you can and cannot see. The transparency is more important than the technical detail — an employee who knows you cannot read their personal WhatsApp will enrol willingly. One who suspects you can will resist, use personal devices for corporate work anyway, and create more risk than the policy was meant to prevent.
What to do when a device is lost
The first 24 hours matter. The policy should specify: employee reports loss immediately (not after looking for it for two days), IT initiates remote wipe of the corporate container, passwords for corporate accounts accessed on the device are rotated, and access logs for the period before the loss are reviewed for suspicious activity. If the device is found, it can be re-enrolled — the wipe is of corporate data, not the device itself.
Mobile security that employees accept
The best mobile security policy is one employees do not resist — because it protects corporate data without invading their privacy. We design MDM and MAM programmes that balance both.
Kinematic Digital designs mobile security programmes for enterprise organisations. See our cybersecurity services and web development practice, or book a mobile security assessment.
Frequently Asked Questions
What is MDM and why does it matter?
Mobile Device Management — a platform that enforces security policies on mobile devices: passcode requirements, encryption, app allow-listing, remote wipe, and containerisation of corporate data separate from personal data.
Should we use MDM for BYOD?
Yes, but with a containerised approach that separates corporate data from personal data. Employees should not feel the organisation can read their personal messages or photos. Containerisation gives security control over corporate data without invading personal use.
What is the difference between MDM and MAM?
MDM manages the entire device. MAM (Mobile Application Management) manages specific corporate applications. For BYOD, MAM is often sufficient and less invasive — it secures corporate apps and data without controlling the personal device.
How do we handle employees who refuse to enrol?
Make enrolment a condition of accessing corporate email and apps. If an employee refuses, they cannot access corporate data on a mobile device. This is a policy decision, not a technical one — HR and leadership must support it.
What is the biggest mobile security risk?
Lost or stolen devices without encryption or remote wipe capability. A device with corporate email and no passcode is a data breach waiting to happen. Encryption and remote wipe are the two controls that turn a lost device from an incident into an inconvenience.