Mobile-device security works best as a lifecycle: know which devices hold work information, enroll them with appropriate controls, keep them supported, prepare for loss, and remove access when their work ends. A small organization can begin with a clear inventory and assigned responsibilities before adding more management features.
Start with ownership and responsibility
Record the device owner, assigned user, model, operating-system version, support status, enrollment method and business purpose. Include the administrator responsible for exceptions and the contact a worker should use after loss. Keep credentials and recovery secrets in an approved secure store rather than in the inventory.
NIST SP 800-124 Revision 2, published in 2023, addresses enterprise mobile security across deployment, use and disposal, including organization-owned and personally owned devices. Its lifecycle approach is useful because the same phone changes risk as software ages, jobs change and access accumulates.
On a narrow screen, scroll the table sideways. Keyboard: focus the table and use the arrow keys.
| Arrangement | Decide before enrollment | Evidence to retain |
|---|---|---|
| Organization-owned device | Required controls, approved applications and permitted personal use | Assigned user, management record and support owner |
| Personally owned device with managed work area | What the organization can see, configure and remove | Enrollment notice, work-data boundary and departure process |
| Approved temporary exception | Which tasks and data are allowed, and for how long | Named approver, compensating measures and review date |
Give employees a plain-language explanation of the selected arrangement. An enrollment screen should agree with that explanation; a different enrollment mode can carry different administrator powers.
Match management to the work boundary
Apple's account-driven User Enrollment is designed for personally owned devices and limits management to organizational accounts, settings and information within that model. Compare its controls with other enrollment methods before selecting a policy. The Apple User Enrollment documentation describes that specific boundary; it should not be generalized to every managed Apple device.
Android's Work Profile documentation explains the separation of work applications and data from personal use. Work apps have a briefcase indicator. Removing a work profile removes its local work data, while a factory reset affects the device more broadly. Have the administrator verify the controls of the actual ownership and enrollment configuration before promising privacy or remote-removal behavior.
Establish a baseline you can verify
Require supported software and a defined update process. Verify screen-lock settings, the platform's encryption status, approved application sources and account protection. An inventory entry that says “secure” is less useful than a dated check with an owner and a specific exception, such as an application awaiting a supported OS update.
Separate device recovery from account recovery. Confirm that staff can recover work access through an approved route if their usual phone is unavailable. Check which work information is synchronized to organizational systems, which remains local, and which backups are permitted. Use a harmless sample document to test restoration into an approved test location. Record the result without placing sensitive content in a help-desk ticket.
For employees, the routine is manageable: install approved updates, keep the screen lock active, report unexpected enrollment prompts, and use the loss-reporting contact promptly. Administrators own policy configuration, compliance review, access revocation and documented exceptions. The Wi-Fi security guide complements these controls when devices use shared networks.
Prepare a lost-device response
Write a short reporting route that works without the missing device. Collect the device identity, approximate loss time, last known circumstances and whether it contained unsynchronized work. An administrator can then assess available location or lock tools, revoke relevant sessions and credentials, and decide which removal action fits the ownership model and incident procedure.
Confirm the command's target and scope before issuing it. A device can remain offline, so a queued remote command needs follow-up evidence. Record separate statuses for access revoked, command requested, command confirmed and remaining exposure. Avoid treating a submitted management action as proof that every local copy has disappeared.
Rehearse this process with a tabletop scenario and a designated test account. Staff should be able to find the reporting contact, and administrators should be able to identify the relevant controls. Do not practice wiping employees' working devices.
Close access cleanly at retirement
Before reassignment or departure, transfer required work through approved systems and verify that pending records have synchronized. Revoke work access, remove organizational data using the documented enrollment-specific method, and confirm the management and inventory records reflect the result. Follow the platform and organization's disposal procedure for the physical device.
Retain completion evidence appropriate to your policy: asset identity, date, responsible administrator, access-removal result and unresolved exceptions. Review the baseline when an OS loses support, an enrollment method changes, or a new application stores work locally. The objective is a process a small team can execute and verify throughout the device's working life.