BYOD and Mobile Device Policy
Sets the conditions under which personal and mobile devices may access Your Organization data and systems: enrollment, minimum security settings, remote access, lost-device handling, and offboarding.
Maps to ISO/IEC 27001:2022 A.8.1 · ISO/IEC 27001:2022 A.7.9 · FedRAMP Moderate AC-17 · FedRAMP Moderate AC-19 · CMMC Level 2 AC.L2-3.1.12 · CMMC Level 2 AC.L2-3.1.18 · CMMC Level 2 AC.L2-3.1.19 · NIST SP 800-171 Revision 3 03.01.12 · NIST SP 800-171 Revision 3 03.01.18
Read it now — the PDF opens either way.
Purpose
Workforce members increasingly use personal phones, tablets, and laptops, and company-issued mobile devices, to reach Your Organization data from many places. This policy sets the conditions that keep company data protected on those devices while respecting the personal data of their owners.
Scope
This policy applies to all workforce members, including employees, contractors, and temporary staff, who access Your Organization email, files, applications, or networks from a device that Your Organization does not fully manage (personal devices, "BYOD") or from a company-issued mobile device. It applies to smartphones, tablets, laptops, and wearables that can store or display company data.
6 more sections in the full template
Roles and responsibilities · Requirements · Exceptions · Enforcement · Evidence · Review cadence. Download the full document above, or open it in CMDash to fill in your organization name and effective date automatically.
Use this policy for real, not just on paper
“Open in CMDash” pre-selects the BYOD and Mobile Device Policy template the first time you create a policy — your organization name and today’s date fill in automatically, and it lands as a DRAFT you can edit before publishing.