BYOD and Remote-Work Security: A Practical Policy Built on NIST SP 800-46, SP 800-124 and CISA Guidance

The place is not the problem. The device and the network are.

Remote work and personal devices are now ordinary. A paralegal answers email from a phone on the train. A manager opens a spreadsheet on a home laptop. A contractor connects from a machine your team has never seen. None of this is new, and none of it is forbidden. The question is what each device is allowed to reach, and what happens when it goes wrong.

The National Institute of Standards and Technology (NIST) says it plainly. In SP 800-46 Revision 2, Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security, NIST states that telework and remote access generally place an organization at higher risk than systems used only from inside the building. The main concerns it lists are the lack of physical security, the use of unsecured networks, infected devices connecting to internal networks, and internal resources being open to outside hosts. It also notes that agreements with employees and third parties that require them to secure their devices generally cannot be enforced automatically, so an unsecured or infected device can still end up connected to sensitive resources.

Start with three assumptions

NIST asks organizations to plan their telework policy and controls on the assumption that outside environments contain hostile threats. In practice that means three assumptions you can write on one page.

• Devices will be lost or stolen. NIST suggests encrypting the device's storage, encrypting sensitive data stored on it, or not storing sensitive data on it at all. To limit reuse of a stolen device, it points to strong authentication, preferably multi-factor.
• Networks you do not own can be watched or altered. Encryption protects the confidentiality and integrity of traffic and lets each end verify the other, though NIST says this reduces the threat and does not eliminate it.
• Devices will pick up malware. NIST names antimalware tools, network access control that checks a device's security posture before granting access, and a separate network for personal devices brought into the office.

These are not pessimistic. They are what lets you decide, calmly, what to allow.

Write a telework policy that tiers access by device

NIST recommends a written telework security policy that defines which forms of remote access are permitted, which types of devices may use each form, what each type of worker may reach, and how the remote access servers are administered. It also recommends making risk-based choices rather than one rule for everyone. Its own example is tiered access: organization-owned PCs may reach many resources, personal PCs and third-party-controlled devices a limited set, and personal smartphones and tablets only one or two lower-risk resources, such as webmail.

NIST lists the factors to weigh: the sensitivity of the work, confidence in the device's security posture, the cost of devices, where the work is done, and compliance requirements. For particularly high-risk work, it suggests allowing it only from organization-issued, secured devices with multi-factor authentication and storage encryption. It also notes an organization may decide to prohibit remote work involving certain types of information, such as sensitive personal data.

A short tier table is often enough. For example: Tier 1, company-managed laptop, full access. Tier 2, personal computer, access through a browser or a virtual desktop, no local file storage. Tier 3, personal phone, email and calendar through a managed app only. Your regulators, your cyber insurer and your clients may add their own limits, so check them before you finalize the table.

Choose a mobile model on purpose

NIST SP 800-124 Revision 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise (May 2023), covers smartphones and tablets. It leaves laptops out of scope, because the management tools for laptops differ. It describes three common deployment models.

• Strict enterprise use. The organization owns the device, limits personal use, and can make trade-offs between security and convenience entirely on its own terms. NIST describes configuring restrictive settings, an allowlist of vetted apps and communication over a VPN.
• Corporate-owned, personally enabled (COPE). The organization owns the device but allows some personal use, such as personal apps and text messages. NIST says the device and its information still belong to the enterprise and that employees should be told about the restrictions and what to expect for privacy. Apps are checked against a blocklist.
• BYOD and choose-your-own-device (CYOD). With BYOD, employees use their own devices to reach company data and services, often reading personal and work email in the same app. With CYOD, the employee buys a device from a list the company has approved.

NIST is candid about the weak point of BYOD and CYOD: the organization has little or no knowledge of where the device came from or whether it has been modified. It may be rooted or jailbroken, carry untrusted apps, or be infected without the owner knowing. NIST also observes that if IT turns away a personal device because it cannot run the company's management agent, BYOD effectively becomes CYOD, only without a published list. Publish the list.

Protect the data, not just the device

For personal devices, the useful question is: what do we need to control? Usually it is the company's email, files and apps, not the owner's photos. NIST SP 800-124r2 describes mobile application management (MAM), which controls company apps without requiring the owner to enroll the whole device. It says MAM may help address privacy concerns of people who use their own devices. It lists what an enterprise can do: restrict which app stores are used, allow or block specific apps (allowlisting is preferable), restrict app permissions, keep an inventory of installed apps, restrict sync and sharing services, and distribute company apps from an enterprise app store.

For BYOD, NIST also describes data loss prevention settings, such as disabling copy and paste inside company apps, so company data does not leak into personal apps. And it recommends mobile threat defense on the device to detect mobile threats and compromise attempts.

On departure or loss, remote wipe comes in sizes. NIST describes a full-device wipe, typically used on enterprise-owned devices, and an enterprise wipe that deletes only the company's settings, data and apps. For personal phones, an enterprise wipe is the right default, and your policy should say so before anyone is enrolled. The administrator must install the management profile or agent before company data is available on the device, so decide this at enrollment, not after an incident.

Keep personal accounts out of business email

NIST SP 800-124r2 warns about sending work through personal email accounts. The company loses security control over the account and over what is stored there, cannot control which servers the mail passes through, cannot back up or archive the messages for a legal request, and cannot remove a departing employee's access to the messages already sent to a personal address. Shared accounts also make it hard to tell who did what. The fix is an old one: company mail on company accounts, with one named person per account.

Secure the door: remote access servers and the VPN

NIST SP 800-46r2 sorts remote access into four types: tunneling (such as a VPN), portals, remote desktop access, and direct application access. All four depend on the physical security of the client device, and all four can let data be copied to the client, including through page files and browser caches. Anything sent to a remote worker should be covered by your data distribution and retention policies.

Because a remote access server is the way in, NIST says to keep it fully patched, configure it to a defined baseline, manage it only from trusted hosts by authorized administrators, and generally place it at the network perimeter. It also recommends authenticating each user before granting any access, using authorization so users reach only what they need, and, where feasible, mutual authentication so the user can check the server before sending credentials. For personal devices used inside your offices, NIST recommends a separate, dedicated network that grants no more access than the same user would have through remote access.

CISA's Enterprise VPN Security alert (AA20-073A, first published March 2020 and last revised April 2020) gives the short list: patch VPNs, network infrastructure and the devices used for remote access; require multi-factor authentication on all VPN connections; prepare staff for more log review and incident response; and warn employees that attackers will target teleworkers' credentials with phishing. CISA's page is now archived and may be outdated, but the controls it names are the same ones NIST points to.

What CISA adds for a permanent remote workforce

CISA's Telework Essentials Toolkit (revised December 2020, now archived) was written for the move from temporary to permanent remote work. It divides the work among executives, IT staff and employees. Its points for leaders are to update policies and procedures for a remote workforce, require cybersecurity training, assess the risk of assets that now sit outside the traditional perimeter, such as home printing, personal email and personal devices, and build a hybrid culture in which the same basics apply to remote and on-site staff.

Its points for IT professionals are: keep hardware and software inventories current so that patching reaches new telework devices, and turn on automatic updates; invest in the controls that connect employees securely, noting that a zero trust architecture may be preferable to a VPN in cloud and distributed environments; enforce multi-factor authentication for remote access and plan for cases where it is not feasible; keep a list of approved products, including collaboration and video tools, and give users guidance on them; run frequent, verified backups stored offline and offsite; and deploy DMARC to reduce phishing and business email compromise. We cover the ideas behind several of these in our articles on zero trust, MFA and passkeys, backups and email authentication.

A one-page BYOD and remote-work policy

• Scope: who may work remotely, from which device types, and for which data. Name what is never allowed on a personal device.
• Tiers: which resources each device tier may reach, and by which method (managed app, browser, virtual desktop, VPN).
• Enrollment: personal devices must run the company's management or app-protection software and meet a minimum operating-system version before they get company data.
• Authentication: multi-factor authentication for every remote login, with phishing-resistant methods for administrators and high-risk roles.
• Storage and encryption: device encryption on, a screen lock, and no local copies of sensitive files unless the policy says otherwise.
• Privacy: what the company can and cannot see or erase on a personal device, in plain words, signed by the employee.
• Lost or stolen: report within a stated time, and who wipes what.
• Leaving: company data removed on the last day, accounts disabled, personal email forwarding checked.
• Home network: change the router's default password, keep its firmware current and use current Wi-Fi encryption; give staff a one-page guide.
• Review: revisit the policy at least once a year and after any incident.

Where regulation comes in

Personal devices do not change your legal duties. If a personal phone holds client files, patient data or customer financial data, it is inside the same breach, privilege and privacy obligations as a company laptop. Healthcare practices should read our article on the HIPAA Security Rule, and Florida businesses our breach-response checklist, before they allow personal devices to reach regulated data. Insurers also ask about remote access and device controls, as our cyber-insurance article explains.

How Clayton Cybernetics can help

Our team has run BYOD and mobile device management for multi-office organizations, including identity, device management and endpoint protection built on Microsoft Intune and Defender. We can help you choose a mobile model, write the policy and tier table, set up device enrollment and app protection, harden the VPN or replace it with a zero-trust access design, and train your people. Call (305) 404-9404 to review your current remote-work setup.

Sources

• NIST SP 800-46 Rev. 2: Guide to Enterprise Telework, Remote Access, and BYOD Security (July 2016)
• NIST SP 800-46 Rev. 2 (full text, PDF)
• NIST SP 800-124 Rev. 2: Guidelines for Managing the Security of Mobile Devices in the Enterprise (May 2023)
• NIST SP 800-124 Rev. 2 (full text, PDF)
• CISA Telework Essentials Toolkit (revised December 17, 2020; archived)
• CISA Alert AA20-073A: Enterprise VPN Security (revised April 15, 2020; archived)
• CISA Telework Essentials Toolkit (PDF, 2020)

This article is general information, not legal advice. NIST SP 800-46r2 (2016) is older than the tools most firms use today, and CISA's telework pages are archived; the principles hold, but check each source for current status. NIST's page also lists a draft Revision 3 of SP 800-46 as a related publication; we could not open it for this review. Confirm your obligations with your counsel. Last reviewed November 8, 2026.

Keep reading

Next · RegulationHIPAA-Compliant Email: When You Must Encrypt, When Patients Can Opt Out, and What to Put in WritingHIPAA does not ban email, and it does not say the word "mandatory" about email encryption today. It asks you to assess the risk, protect messages in transit, and decide in writing. This article explains what the rule requires, how patient preferences fit in, and a workable email policy for a medical or dental practice.8 min read

• Penetration Testing Explained for Executives: Scope, Reports and How Often to Test8 min
• Ransomware Readiness and Incident Response: A Checklist Based on the CISA #StopRansomware Guide9 min