1. Purpose & Scope

This policy governs remote access to [Organization Name]'s systems and the use of personal devices (BYOD) for business purposes. It applies to all employees and contractors who work remotely, access company systems off-premises, or use a personal device for work.

2. Definitions

BYOD: Bring Your Own Device — a personally-owned device used to access company systems or data.
Corporate-Owned Device: A device purchased and issued by [Organization Name], subject to standard company management.
MDM: Mobile Device Management — software that enforces security configuration and enables remote wipe on enrolled devices.

3. Eligibility & Approved Devices

Remote work and BYOD eligibility is determined by [manager / HR / role]. Approved device operating systems and minimum OS versions are maintained by [IT] and updated as platforms reach end of support.

4. Device Enrollment & MDM Requirements

Any device — corporate-owned or BYOD — accessing company email, files, or systems must enroll in [Organization Name]'s MDM/MAM solution. BYOD enrollment requires the device owner's consent to the company's ability to enforce security configuration and remote-wipe company data (not personal data) from the device. Corporate-owned devices are provisioned with the organization's standard security image before issuance.

5. Remote Access Requirements

All remote access to internal systems goes through the organization's VPN or zero-trust access solution — direct exposure of internal systems to the public internet is not permitted
MFA is required for all remote access, per the organization's Password/MFA Policy
Public Wi-Fi may only be used with the organization's VPN active

6. Data Handling on Remote/Personal Devices

Company data stays in company-approved applications and storage — no syncing to personal cloud storage (personal Dropbox, iCloud, personal Google Drive)
Data classified as confidential or regulated (PHI/PII/PCI) is accessed through approved applications only, not downloaded to local personal-device storage
Device encryption (full-disk or equivalent) is required on any device storing company data

7. Physical & Environmental Security for Remote Work

Lock your screen whenever you step away from your device, regardless of location. Take reasonable care that screens and conversations involving confidential information aren't visible or audible to others in shared or public spaces. Shred or securely dispose of any printed material containing company or customer data.

8. Home Network / Equipment Requirements

Home Wi-Fi networks used for work must use WPA2 or WPA3 encryption with a non-default password. Default router administrative credentials must be changed from the factory default.

9. Lost or Stolen Device Procedure

Report a lost or stolen device to [IT/Security] immediately, regardless of time of day. [IT/Security] will trigger a remote wipe of company data on the device per the Incident Response Plan. Delay in reporting is itself a policy violation, independent of how the device was lost.

10. Support & Reimbursement Boundaries

[IT] provides support for company-owned devices and for the company-managed applications on enrolled BYOD devices. [IT] does not provide general technical support for personally-owned hardware or operating systems. [Reimbursement policy for equipment/internet, if applicable, goes here.]

11. Employee Responsibilities & Acknowledgment

Employees using BYOD acknowledge and consent to MDM enrollment and the company's ability to remotely wipe company data from their device, including in the event of termination, loss, or theft.

12. Enforcement

Violations of this policy, including failure to report a lost device promptly, may result in disciplinary action up to and including termination of employment or contract, and removal of remote access privileges.

13. Policy Review

This policy is reviewed at least annually and following any material change to remote work arrangements or supported device platforms.

Remote Work & BYOD Policy