What Microsoft 365 Apps for Business Come Included?
A member of staff leaves a personal phone on a train. It has work emails on it, access to shared files, and probably a client contact list. No remote wipe, no encryption, no record of what the device could reach. This is one of the more common ways business data ends up somewhere it shouldn’t be, and in most cases, it’s preventable.
When staff use personal devices for work, data travels beyond your IT controls. Security for BYOD (Bring Your Own Device) exists to close that gap. Without the right controls, the flexibility of remote working comes with a blind spot that is easy to miss until something goes wrong. Getting this right does not require a complete overhaul. If you are already reviewing your IT security arrangements, this is a practical place to start.
This guide covers the risks, the controls, and how to build a BYOD policy that holds up.
Personal devices sit outside your business’s normal IT controls. The phone your team member uses to check work emails is also the phone they use for personal apps, banking, and software downloads you have never seen. You own the data on it. You do not own the device.
According to the National Cyber Security Centre (NCSC) guidance on BYOD, reviewed in May 2025, the effectiveness of BYOD data protection depends on how thoroughly devices can be managed and how well usability and security are balanced [1].
The guidance identifies four core challenges organisations face when personal devices are in use:
A device your business cannot manage is one that it cannot wipe if it goes missing. Your IT security services cannot reliably protect a device running an unsupported operating system, and separating company data from personal apps becomes considerably harder without the right controls.
Businesses that have experienced a phone hack or data breach know the cost goes well beyond the immediate incident. The reputational and operational fallout from landline fraud alone can take months to recover from.
Mobile security best practices are not complicated, but they require a decision to put them into practice. Most businesses that experience a data loss through BYOD do not lack the tools. They lacked the setup.
Businesses sometimes discover a security gap only after the damage is done. A phone hacking incident handled by our team just goes to show how quickly an unmanaged device can become a costly problem, and what a managed response looks like.
Here are some of the lessons that can be learned from it.
Multi-factor authentication (MFA) should be active on every account your staff accesses from a personal device. A password alone is not enough to gain access; a second verification step is required, whether that is a code sent to another device or an authentication app. Encrypting data on the device adds an extra layer of protection. This way, if the phone is lost, the information on it cannot be read by whoever picks it up.
NCSC guidance on Mobile Device Management (MDM), reviewed May 2025, describes MDM as a service that combines device applications, built-in management features, and infrastructure services. It gives your organisation the ability to remotely control, monitor, and enforce policies across enrolled devices, wherever they are in use [2].
The NCSC notes that a BYOD approach may significantly limit the technical controls available, making it more important to choose and configure the right MDM service. For businesses with IT support already in place, MDM is a standard part of a managed mobile environment.
Staff working remotely, particularly over public networks, should connect through a VPN to encrypt data in transit between their device and your systems. Every device used for work should also be running current software, as older operating systems carry known vulnerabilities that a straightforward update would close.
Mobile devices used for work are also exposed to SIM-based threats that software updates alone cannot prevent. SIM swap fraud targets the identity of a device rather than the data on it and is worth understanding as part of any mobile security review.
Having a BYOD policy and having staff members follow it are two different things. The NCSC’s guidance on developing a BYOD policy, reviewed in May 2025, notes that overly restrictive controls can prompt staff to find workarounds, increasing security risk rather than reducing it. A policy that is too vague gives no real protection [3].
The guidance confirms MFA as a minimum requirement for access to BYOD-approved services. Beyond that, a workable business data protection policy for IT security for remote workers needs to cover three things directly:
Role-based access is also worth building in. Limiting staff to the systems relevant to their work reduces the damage if any device is compromised. Businesses that pair this with business mobile contracts that include monitoring and fraud protection gain an additional layer of visibility over how devices are used.
Businesses in sectors where data sensitivity is higher will often need stricter controls. Phone and IT solutions for professional services cover the additional compliance considerations that apply to firms such as solicitors, accountants, and financial advisers.
Without the right controls, BYOD is a known risk. Data sits on devices that your business cannot manage or recover if something goes wrong. With them, it is a practical way to support flexible working without creating exposure you find out about too late. The difference comes down to having authentication, device management, and a clear policy in place by design, not by assumption.
Town & Country Communications has been working with businesses across Dorset, Hampshire, and Wiltshire since 1992. Our IT security and managed IT support services cover device management, data protection, Microsoft 365, and 24/7 support, giving smaller businesses everything they need to run BYOD safely without a dedicated internal IT team.
Call 01202 514444 or arrange a free consultation to talk through your current setup.
[1] GOV.UK, National Cyber Security Centre (NCSC), Device Security Guidance, Bring Your Own Device (BYOD) (2025): https://www.ncsc.gov.uk/collection/device-security-guidance/bring-your-own-device
[2] GOV.UK, National Cyber Security Centre (NCSC), Device Security Guidance, Mobile Device Management (2025): https://www.ncsc.gov.uk/collection/device-security-guidance/getting-ready/mobile-device-management
[3] GOV.UK, National Cyber Security Centre (NCSC), Action 2 – Develop the Policy (2025): https://www.ncsc.gov.uk/collection/device-security-guidance/bring-your-own-device/action-2-develop-the-policy
