Hidden Cost, Hidden Danger? A Guide to BYOD

Mobile devices give small businesses a competitive edge by helping them get more work done in the field and on the road. When it comes to devising a mobile strategy, small business owners must decide whether to provide company-owned mobile devices, or to let employees use their personal devices—a practice more commonly known as Bring-Your-Own-Device, or BYOD.

At first glance, a BYOD program sounds like a no-brainer. Small companies, particularly those on a shoestring budget, can ill-afford to provide employees with mobile devices, so why not save a few bucks and let them bring their own? However, the cost of the mobile devices is just the beginning when it comes to company mobile use in general—and BYOD in particular. It behooves you to know exactly what you’re getting into before you decide to make the move or stay put.

small business BYOD

Besides hidden costs incurred in the course of running a BYOD program, there are several hidden dangers to contend with as well. However, you’ll find some of the same issues with company-owned devices too. Indeed, some people think that adopting a BYOD program eliminates these issues. But the issues aren’t that simple. Here is what you need to know to decide which mobile strategy is best for your company.

Small Business Mobile Strategy Considerations

The good news about mobile devices is that your employees can work from anywhere. The bad news is that they can also work at anytime. Working after hours on a mobile device, whether it is company-owned or a personal device, may make you liable for paying the employee overtime. In the case of personal devices, it may also make you liable for footing a proportionate amount of the employee’s carrier costs as well.

“BYOD does not mean that you pass along all the mobile phone costs to your employees,” says David Alison, founder of EasyGrouper, a mobile communications platform provider. “Recognize that you should be responsible for some level of reimbursement for the cellular and data costs that your employees incur.”

He cited a recent California ruling that required employers in that state to do exactly that, and he says that similar laws will spread throughout the country. Some may even be retroactive, so you’re better off if you take care of that issue proactively. “Have a mechanism in place for reimbursement, whether you decide to pay for a certain percentage of your employees’ cellular bill or require more detailed expense reporting and usage tracking,” he said.

Remember: when you calculate costs for BYOD, you need to factor in the carrier costs, too— not just the cost of the physical devices.

Another important point you must to consider: how to maintain control over your company information. Requiring employees to use company-provided mobile devices doesn’t mean that company data will stay off of their personal mobile devices. Employees often use their personal devices to do company work even when they have a company device available—simply because they prefer their own device, they don’t want to take the time and effort to find the other phone, or boot up the company laptop.

Another common misconception is that allowing employees to use their own devices for work exacerbates this problem. Actually, many carriers now provide the means to provision one device with two phone numbers. This separates company information from the employee’s private information, which often solves the issue.

“When you make the move to BYOD, it’s important to have a mobility solution that lets employees separate their business and personal communications on a single device. A ‘dual persona’ solution maintains separate identities,” says Pej Roshan, vice president of product management at ShoreTel, a phone system provider.

“Employees never need give a customer their personal mobile number again; instead their company number follows them from desk to field,” he added. “And managers can rest easy knowing that customer lists [and other company data] stay with the company, not with the employee.” 

You can also protect company data on a personal device by the use of “containers.” This is simply a technical way of wrapping and protecting company data—and thus separating it from personal data on the same device. Several carriers and phone system companies offer this technology.

By using containers and dual persona devices—or a combination of both—you can wipe your data from any personal device (if it is lost or stolen, or if the employee leaves the company) without disturbing the employee’s data. This is vital, as companies have been sued in the past for wiping personal data—ranging from photos to a novel-in-progress—from an employee or former employee’s device in an effort to secure company data.

Small Business BYOD: Legal Considerations

Protecting the employee’s data on the device from your company’s security wipe is not the only issue you need to address regarding personal rights in a BYOD program.

David Willson, an attorney at Titan Info Security Group, a risk management and cyber security law firm, recommends that you address the following issues in your company policy. Have all employees agree to—and sign—the policy before allowing the use of personal devices for work:

  • Include a right to monitor, remote track and remote wipe the employee’s mobile device
  • Require the employee to report a lost or stolen device immediately
  • Require acknowledgment and acceptance from the employees that if the employee stores photos or other personal data on the device, it may be deleted in a remote security wipe
  • Require that the employee make the device immediately available to the company for purging of all company data upon the employee’s termination or resignation

“You can include many more provisions, however, the bottom line is to offer employees the option to use their own mobile devices—but only if they agree to the policy,” he said. “If any employees reject the policy, then offer them the company device instead.

Must Read

Get the Free Newsletter!

Subscribe to Daily Tech Insider for top news, trends, and analysis.