Building a good mobile device policy is your best tool for successful BYOD implementation.

High-function/low-cost mobile information devices have changed the corporate IT environment in mysterious ways, not the least of which is a culture of "Bring Your Own Device (BYOD)."

BYOD is a growing phenomenon by which corporations permit employees to use personally owned mobile devices (laptops, tablets, and smartphones) in the workplace and to use those devices to access privileged company information and applications. This new paradigm would have been an anathema to security auditors only few years ago, but now BYOD has become the up-and-coming trend for managing data with portable devices.

According to Forrester Research, more than half of U.S. information workers now pay for their own smartphones and monthly service plans to do work for their employers, and three-quarters pick the smartphone they want, rather than accepting IT's choice. In high-growth markets—such as Brazil and China—the ratio is greater than 75%.

What's even more startling is that Gartner estimates that 38% of companies expect to actually stop providing devices to workers by 2016 and that 85% of companies will be providing BYOD options for their employees. This means that only 15% of companies will prohibit the practice of using personal equipment to access corporate information—a security trend reversal that has many security analysts scratching their heads. The pace of change is extremely rapid, and though BYOD presents significant challenges to IT security, tech support, asset ownership, and equipment standards, corporations see it as a means of lowering costs for equipment and services by shifting the responsibilities for maintaining the equipment and services away from the corporate balance sheet.

BYOD and the Consumerization of IT

So what is BYOD, and how can IT control its influence in the organization?

A Bring Your Own Device (BYOD) program comprises corporate technology policies and procedures to provide a secure mobile computing environment on the devices employees want to use. But BYOD is not just a technology issue. It's also a central business issue that demands an effective approach encompassing business strategy, policies, and systems.

How did we get here? Employees have become increasingly accustomed to the concepts of self-serve IT. Things like Software as a Service (SaaS), cloud computing, and the manner by which mobile telephony is supported have transformed employee expectations of IT service. Instead of trying to solve problems through IT's help desk, these employees have become increasingly tech-savvy, with their own ideas of what their computing and communication devices should deliver. This trend paved the way to a consumerization of IT services, in which users choose the devices that best help them perform their jobs.

But now that BYOD is becoming more common, it's important to have the management in place to ensure that the use of personal equipment is both successful and secure. BYOD programs should reflect best practices that recognize and embrace the inevitability of so-called "consumerization," yet offer "built-in" flexibility and adaptability because those best practices are emerging and changing as quickly as the mobile environment.

Create a Policy

While the basic concept of BYOD seems simple, it's imperative that your company establish a written policy that meets management criteria before you start permitting employees to access data and services with their personal devices. The policy should specify what types of devices are permitted (cell phones, laptops, tablets, etc.) and how data plan payments will be managed (via stipend or expense report). Identifying the compliance regulations that govern the data managed by the organization should be documented in the policy, and the personnel records documenting an employee's acceptance of the formal policy should be maintained by the Personnel Department. Employees who will participate should sign off on the policy before they bring in their own devices.

Security and BYOD

Fundamentally, an IT department must develop practices that protect corporate data while maintaining employee productivity. This involves the participation and cooperation of other departments, including human resources, purchasing, legal, financial, and the lines of business that own the data. All policies about data protection need to be incorporated into the BYOD policy.

Still, there are a host of issues related to security, many of which may never have been addressed by the organization before.

For instance, what are the rules about accessing corporate data with an illegal device, such as a cell phone that's been jail-broken or a tablet that has been rooted? What about the use of apps that may compromise the security policies of the organization, such as a data-sharing app like Dropbox, an IP-scanning app, or even pirated apps? Should you permit a phone to access your system if its internal securities established by the phone vendor have been compromised? What should IT's response be if devices are discovered to be outside the security parameters established by the organization?

Security also extends to concern over the services that the device may be accessing—for instance, virtual private networks (VPNs), Software as a Service (SaaS), external email services, etc. Does the organization ban access to unauthorized services? Or does it establish policies to monitor the use of those services? If it does the latter, how does that impact the privacy of the employee?

Privacy itself is a security issue that is fraught with potential conflict. For instance, what data is the organization collecting about the use of the personal device? How is that data managed? Is there a strong demarcation between company-owned data and employee-owned data? How is that demarcation managed? What personal data is never collected?

All of these concerns should be identified in the BYOD policy, and the policy should be revisited on a regular basis as technology changes or challenges develop.

Setting Standards: Know What Your Users Want to Use

It would be nice if everyone wanted to use the same devices and those devices all had the same capabilities. But mobile technology is changing so quickly and new devices are coming into the public use so rapidly, it's impossible to predict which device will be the next hot item your employees will want to use. Instead of identifying devices, you need standards that identify the minimum services that a device should be able to manage. Still, those standards should be flexible.

For instance, setting an OS level for a cell phone is too restrictive, but standardizing around the ability to multi-task, send text messages, review video, and receive email sets a bar of functionality that empowers your employees. And don't sweat the technical details: if the functional standards are too high for an employee's device, they have the option of buying a new device with their own paycheck to meet the standard.

Some of the things that you should specifically consider:

• How will you manage your mobile deployment in a BYOD world without risking sensitive data or intruding on employee's rights to      privacy on devices they own?
• How will you distribute applications to and manage applications on employee devices?
• How will you develop secure applications for mobile devices?
• Will you have cross-platform (iOS, Windows Mobile, and Android) knowledge, tools, and apps?
• What applications should you deploy—email, time and expense management, corporate directories, CRM?
• Will you provide intranet access to BYOD users?

Simplicity and Self-Service

To be effective in your IT setting, your BYOD enrollment process should be simple to accomplish and simple to administer. This is the place where "self-service" by the employees becomes crucial. If the steps to enroll a device or to access a service are too complex, you've lost one of the primary management advantages of BYOD.

For instance, over-the-air (OTA) configuration (making access to email, contacts, calendars, VPN, corporate and public documents) should be easy to implement. What you don't want is some arcane process of individually loading software onto a device inside an IT cubicle.

Likewise, self-service should permit users to perform PIN and password resets, to locate lost devices through geo-location mapping services, and to wipe a lost device remotely. These self-service management processes can help remove some of the most common stumbling blocks of BYOD implementation.

Managing Information and Apps

Perhaps the largest challenge facing BYOD implementations is managing the data and the apps that are used on employee devices. There are, as yet, no well-established cross-platform information management packages that handle the mixture of data and apps in a rigorous, transparent, and secure manner.

Some of the things that a good management package for BYOD administration should do include:

• Information Isolation—Keep an employee's personal information separated from corporate data. You want the employee to be able to access corporate data, but you don't want the corporation to track or access the employee's personal data. How a proposed management system handles this co-mixing on a single device is important to protect the corporation from privacy infringement lawsuits.
• Monitoring and Messaging—When a device has been rooted or jail-broken, the system should be informed. Likewise, security policy breaches should be communicated between the system and the device. Standard upgrade info, such as the availability of a new app or new OS, should be managed through SMS or other automatic communication.
• Data Usage—When an employee's device approaches the limits of subscribed data usage, the system should be aware, and your      company's BYOD policy should specify how overage charges will be handled.

Open Up BYOD Bit by Bit

The promise of BYOD is to lower the cost of maintaining a mobile workforce by distributing the costs and the responsibilities to the employees themselves. But though the devices themselves are now affordable and readily available—with employees raring to use their own devices in the service of the corporation—it's best to roll out the policy in a limited manner while IT and management work through the potential problems. Start small, choose your employees and their devices wisely, and then accelerate as you gain experience.

BYOD implementations are new, and though there's plenty of enthusiasm and potential for a successful implementation, there's also plenty of time to get the policy right and the management packages in place before you run into problems.