Personal Device Security for Medium- to High-Risk Work

A personal device isn't set up the way a work laptop is. Nobody's checked that it's locked down, up to date, or free of other apps and accounts mixed in with work stuff. You can't turn it into a full company laptop that's not realistic. What you can do is either keep the sensitive work in a separate, protected space on the device that can be wiped if needed, or avoid putting it on the device at all. 
 The basics 
 
 
 
 Control 
 What it means 
 Why it matters 
 
 
 
 
 Encryption 
 Turn on full-disk encryption (BitLocker on Windows, FileVault on Mac) and ensure it's on 
 Phones and laptops don't always come encrypted by default 
 
 
 Screen lock 
 Auto-lock after 5 minutes or less, with a PIN/password or fingerprint/face unlock 
 Stops someone from just picking up an unlocked device and looking through it 
 
 
 Keep devices and browsers updated 
 Turn on automatic updates 
 Most break-ins happen through known holes that a software update would close 
 
 
 Two-factor login 
 Require a second step (code, key, or app approval) to log in anywhere sensitive 
 A stolen password alone shouldn't be enough to get into anything important 
 
 
 Separate work space 
 Use a work profile or separate browser profile that keeps work stuff separate from personal photos, texts, apps 
 Lets the work data get wiped without touching anything personal on the device 
 
 
 No random file syncing 
 Don't let personal Dropbox, personal Google Drive, etc. touch work files 
 Keeps sensitive files from quietly ending up in the wrong place 
 
 
 Remote wipe 
 Make sure the work data can be wiped remotely if the device is lost, using Google Workspace, MS 365 or another service 
 Losing a device only becomes a real problem if the data on it is still readable 
 
 
 
 Quick test: if your device were lost tonight, could whoever found it get into sensitive records, passwords, or personal info? If yes, it needs all of the above before it's used for work. 
 Putting it into practice 
 New staff: A new staffer's device should meet the basics above before it's allowed anywhere near sensitive work. Check that encryption is on and the software is current. 
 Handling the data: For medium-risk work, a separate work profile with some basic restrictions (no copying files out, no plugging in random USB drives) is usually enough. For high-risk work, it's better if the sensitive data never lands on the device at all. Access it through a browser-based tool or remote desktop instead. 
 By how sensitive the work is: 
 
 
 
 
 Medium-risk work 
 High-risk work 
 
 
 
 
 Where the data lives 
 In a separate work space on the device 
 Nowhere on the device - accessed remotely only 
 
 
 Copying or downloading files 
 Restricted 
 Not allowed 
 
 
 Staying logged in 
 Fine day-to-day, re-verify for sensitive actions 
 Log back in often 
 
 
 
 If a device is lost, stolen, or acting weird 
 Wipe the work data remotely right away. Cut off that device's access and log it out everywhere. Look back through recent activity on the account for anything unusual. Report it right away.