Staff using personal phones for work: what the NCSC advises small firms to set up

Most small businesses already run on personal devices, whether or not anyone decided that. A bookkeeper checks email on their own phone. A part-time team member opens the booking system on a home laptop. The National Cyber Security Centre (NCSC) calls this "bring your own device", or BYOD: staff use hardware they own for work, while the organisation owns the business data on it. The question is not whether it happens in your firm, but whether you have set any rules for it.

What the NCSC says about BYOD

The NCSC's BYOD guidance lists the aims people usually have: letting staff use technology they are comfortable with, lowering the cost of buying equipment, supporting flexible and remote working, and keeping work going if people cannot get to their usual workplace. It is also direct about the downsides. The risks it names include making sure devices and their owners follow your policies, supporting many different device types, protecting business data, protecting the owner's personal privacy, meeting legal and contractual duties, and keeping a sensible balance between work and home life.

That last point matters more than it looks. The NCSC warns that a badly designed scheme may lead staff to reject it or to use "shadow IT", meaning their own unapproved tools and workarounds, which raises the risk rather than lowering it. The guidance is written mainly for larger organisations, so treat it as a framework to scale down, not a checklist to copy.

It also reminds you that the choice is yours. The guidance asks organisations to decide what approach suits them, "if any". For some firms the honest answer is to buy two or three company phones and avoid the question altogether.

Start with what staff can and cannot do

The NCSC's advice on writing a BYOD policy begins with the goals. It suggests deciding which tasks are allowed from personal devices and which are not, and writing down what users should not do. Its example is that submitting expenses might be fine from a personal phone while changing supplier bank details is not.

It also says that people with privileged or administrator access should not get that elevated access from a personal device, although they can have standard access. For a small firm, that is a simple rule: the person who can change the website, the payment settings or the domain should do it from a device you control.

Other policy points from the NCSC that translate well to a small business:

• Decide which device types are allowed, and whether someone can use more than one. The guidance notes that being capable of BYOD does not mean a device should be used for it.
• Set minimum software versions. Older or unsupported platforms are more likely to have weaknesses that cannot be fixed.
• Plan what happens when someone changes phone, changes role or leaves, including how you remove access and business data.
• Plan what happens if a device is lost, stolen or compromised, and who people tell first.
• Decide whether devices can be used abroad, and if so whether you want to restrict which countries.
• Tell staff what the policy is and why. The guidance warns that controls which hurt usability push people towards workarounds.

The device basics every phone and laptop needs

The NCSC's guide for small organisations is clear that locking down personal devices used for work matters as much as locking down company equipment, because criminals could reach business information through them. Its basics are quick to check:

• Screen lock: require a 6-digit PIN or a strong password to unlock the device or when it starts up. Fingerprint or face recognition is preferred, but a PIN or password is still needed as a backup. Use a different one on each device, and avoid sequences like 123456. Three random words make a strong password.
• Updates: keep devices, their software and their apps up to date, ideally on reliable Wi-Fi with the device plugged in. Replace devices that no longer receive updates.
• Apps: turn on automatic app updates, delete apps you no longer use, and download only from official stores or websites.
• Browsers, antivirus and firewall: keep browsers updated and confirm that antivirus and firewall protection are switched on.

A short written note covering these points, which staff read and agree to, is a good start for a team of a few people.

Technical controls, scaled to your size

The NCSC's guidance on technical controls says the options depend on how you let people connect and which products you use. For most small firms the realistic choices are two.

The first is browser access to cloud services such as email, accounting or a booking system. Here the NCSC's main point is to enforce strong authentication on business services, with multi-factor authentication as the minimum. If your business accounts do not have it switched on, do that first.

The second is controlling apps or devices through management software. The NCSC describes mobile device management (MDM), which can check whether a device is up to date, spot jailbroken devices and banned apps, and remotely remove access to business resources. It also describes mobile application management, which controls only the business apps. These controls can restrict copying data from business apps into personal ones and can remove access to the business apps and their data without touching the rest of the phone. That second approach is often easier to explain to staff, because it leaves their photos and personal messages alone. The NCSC also notes that some device-level controls, such as blocking access when a device is non-compliant, may not suit personal devices.

The guidance adds that you should test your controls before rolling them out to everyone. In a small firm, that can be as simple as trying the setup on one volunteer's phone first.

If you are weighing up how much of this you want to run yourself, our cloud and security team can help you set up sensible access controls for business accounts.

Do not forget data protection

The Information Commissioner's Office (ICO) says UK GDPR requires "appropriate technical and organisational measures" to protect personal data, and that there is no one-size-fits-all answer. Its security guidance lists policies on BYOD, if you offer it, as part of device security, and says that if you allow home working you need safeguards so that it does not compromise your security. It also expects appropriate access controls, so that personal data is accessible only to people you have authorised. In practice, that means customer lists and staff records should sit in a system you control, not in a personal WhatsApp group or a private cloud folder.

What to do this week

• List who uses a personal phone, tablet or laptop for work, and what they use it for.
• Switch on multi-factor authentication for email and any system holding customer data.
• Check each device has a screen lock, current updates and automatic app updates.
• Decide what is off limits from a personal device, such as changing bank details, payment settings or admin accounts.
• Write a one-page note on lost devices and leavers, including who removes access and how quickly.
• Tell staff plainly what you can and cannot see on their own device.

None of this needs expensive software. The aim is the same one the NCSC sets out: decide your objectives, set a clear policy, and put controls in place that people will actually follow.