BYOD
Bring Your Own Device
Dienstliche Nutzung privater Endgeräte
BYOD denotes the practice of using private smartphones, tablets or laptops for work as well — with access to email, calendar, messengers or business applications. The device belongs to the employee, while part of the data and access on it belongs to the organisation. The result is a device that IT controls only to a limited extent but that operates with full privileges.
History & facts. BYOD spread with the smartphone: employees wanted to use their own devices, organisations saved on procurement and management. In security terms, control shifts — the device holds session tokens, authenticator apps, messenger histories and company documents, but updates and installed apps are decided by the owner. BYOD is usually contained technically via Mobile Device Management (MDM) or mobile application management with separate work profiles, minimum versions and device-based access policies of the identity provider.
Outlook & recommendation. Under Network and Information Security Directive 2 (NIS2), private devices with company access also belong in risk analysis and asset management — a device that is not in the inventory can neither be assessed nor cleaned up in an incident. A written BYOD policy is advisable, covering minimum requirements (current operating system version, screen lock, encryption), the separation of work and private data and the procedure in case of loss or compromise. For exposed persons such as management and key staff, a managed company device is usually the better choice.