Frame the risk in operating terms
Mobile devices combine identity, email, files, authenticators and communication in one portable endpoint. Corporate ownership and bring-your-own-device arrangements create different authority and privacy boundaries. Define the business data and applications being protected before selecting controls, and explain clearly what the organisation can and cannot see.
Treat the subject as an operating system rather than a product setting. The accountable owner is the endpoint and identity owners with human-resources and privacy input. Important decisions include which device models are permitted, what managed state sensitive apps require, which data can be stored locally, how loss or compromise is handled. Record assumptions, dependencies and accepted exceptions so a future reviewer can distinguish deliberate design from accidental exposure.
Engineer a controlled path
Require supported operating systems, screen protection, encryption and device integrity for sensitive access. Use application-level protection when full device management is inappropriate. Separate work data, limit local storage and sharing, and provide a rapid enrolment and replacement process so security does not depend on delaying legitimate work.
Build the control path in layers: supported device policy, device or application management, conditional access, work-data separation, tested loss response. Apply stronger safeguards where a failure could change production, expose sensitive information or block recovery. Pilot changes with representative users and services, define rollback criteria and make emergency access narrower and more observable than ordinary administration.
Operate from evidence, not reassurance
Track support status, management health, risky configuration and devices that stop reporting. Integrate mobile state with access policy and revoke sessions when a device is lost. Test remote lock or selective wipe on representative platforms, including offline behaviour and the effect on personal information.
Useful evidence includes management compliance, access decisions, device support status, remote action results, session revocation records. Keep collection protected from the systems being observed, test that records arrive when expected and assign a person who can act on a meaningful signal. Measures such as managed access coverage, unsupported device age, lost-device containment time, selective-wipe test success should lead to a decision, not merely decorate a dashboard.
Exercise failure and improve the design
Use a test account and device to simulate loss during travel. Measure reporting, identity containment, remote action, evidence and replacement. Confirm that responders understand whether the device is corporate or personal and apply only the authorised action. Review recovery of authenticators as carefully as recovery of data.
Run a bounded exercise that forces the team to use real contacts, authority, evidence and recovery paths. Capture what was known, what was assumed and which action changed the outcome. Give every improvement an owner and validation method, then repeat the difficult part after the change instead of closing the work on written assurance.
What to do next.
- ✓Define corporate and personal device boundaries.
- ✓Require supported and encrypted devices.
- ✓Protect work data at application level.
- ✓Connect device state to sensitive access.
- ✓Test lost-device and offline response.
- ✓Provide secure authenticator recovery.
Use guidance responsibly
Technology, provider behaviour and legal requirements change. Validate implementation details against current official documentation, test changes safely and obtain qualified legal advice where required.