A 20-person oil and gas exploration business recently faced a dilemma when a senior-level executive left, taking his personal Blackberry with him. "He had pictures of his kids, along with emails about deals they were renegotiating and all sorts of corporate contacts," says David Rosenbaum, who runs Real-Time Computer Services http://www.rcsinc.com in Ardsley, NY, and worked with the firm.
But, the company had only recently started allowing employees to use their own mobile devices for work and had little experience dealing with the matter. Should they wipe out everything on the device, including pictures of vacations and weddings, or let it all remain with an assurance from the executive that he would delete corporate data on his own?
In the end, according to Rosenbaum, the company decided not to wipe out the data. Instead, the owners would take the executive, a long-time and trusted employee, at his word that he would get rid of sensitive corporate date from his Blackberry.
BYOD: It's an inexorable wave you can't ignore. An acronym for Bring Your Own Device, the term, of course, refers to the growing trend for employees to use their own, personal iPhones, Androids, iPads or other equipment instead of company-owned and supplied gizmos.
It's also by no means just a big company phenomenon. In fact, 70% of small businesses recently surveyed said that BYOD was inevitability at their firms, because so many employees were demanding it, according to Austin-based market research firm iGR.
But, as Rosenbaum's client discovered, turning your small company into a BYOD workplace isn't as simple as it might seem at first glance. There's a wide range of security and management issues you need to consider. And, for small businesses that might lack the resources or staff to oversee and support all those different devices, it can be a particularly delicate matter. "BYOD can bring enormous productivity gains," says Herve Danzelaud, vice president of business development for Good Technology, http://www1.good.com/, a mobile security consulting firm in Sunnyvale, Cal. "But it's not always easy to implement."
The answer is to think through all the potential issues beforehand and, when appropriate, include them in a written corporate policy. With that in mind, here's a look at four major considerations and the best way to approach them.
When employees lose their device—or leave the company
One big issue is the one that faced Rosenbaum's client: what to do if, say, an employee forgets an iPhone in the airport—or just plain quits? Since the device undoubtedly was connected to your server, you have the ability to wipe out all those emails about, for example, confidential plans. But that also means eradicating the personal pictures, music and other applications probably sitting on the device, as well.
Your best move: This is an issue where having a written policy is of utmost importance. The central matter: Who owns the data residing on employees' devices? With that in mind, your policy should include that, when employees leave your company, the data on their devices will be wiped out. Same thing goes for, say, an iPad forgotten on a suburban commuter train. Another approach: separate corporate and personal data, requiring different passwords to get in. "Employees would need a very strong password to access company data and a different one for personal data," says Danzelaud. In addition, you should alert employees to the need to back up their personal photos, contacts and the like, and, perhaps, provide guidance on how to do that.
Or, you can take another tack. State you won't wipe out data but, at the same time, employees are obligated not to use confidential information once they leave the company.
One exception might be if you're in an industry, like healthcare, where you deal with highly regulated, sensitive information. In that case, according to Rosenbaum, you might not want to chance it at all. He recalls one client, a doctor's office, that recently decided not to allow BYOD due to concerns about patient data confidentiality,
How to support all those devices
Most likely, you have a small IT staff, or maybe none at all. How, then, can you support the additional devices your employees will be using without hiring more people or adding to your already over-worked staff?
Your best move: It all depends on your resources. The fewer you have, the less responsibility you'll be able to assume. Rosenbaum points to a client, a 14-person accounting firm that recently allowed employees to use their iPhones. With just an office manager handling support, company owners made it clear that employees were responsible for handling technical problems. "I took care of connecting the phone to the server, but after that, it wasn't part of the office manager's responsibilities," says Rosenbaum.
One helpful move is to limit the devices you allow. Another is to create a checklist of steps employees must take, anything from turning on spell check to using a standard signature block at the end of each email.
Dealing with distractions
If employees have access to personal devices with their favorite apps in easy reach, the opportunity to spend valuable time playing Angry Birds may be too tempting to ignore.
Your best move: You need to lay out expectations regarding just what employees should use their devices for during work time. Don't get too strict, however. "That won't be good for morale or productivity," says Rosenbaum. But make it clear their priority should be to get their work done-- and not to do anything that could embarrass the company.
Other than that, it's mostly a matter of performance. "If a person is productive, we don't make an issue of it," says Tim Phelan, COO of InfoSystems, http://www.infosystems.biz/, a 55-person IT consulting firm in Chattanooga. "If someone chooses to spend an hour on Facebook and they're accomplishing everything they need to accomplish, we're okay with that."
Another approach is to do what you can to make employees' use of their own devices as productive as possible. To that end, Phelan's company holds a monthly pizza party during which people share something interesting they've done with their personal mobile equipment. One marketing employee recently demonstrated new ways to use Twitter to win clients, for example.
The temptation to contact employees 24/7
Fact is, you know your employees will have their devices with them, turned on, much of the time. So there's more of a temptation to contact them on their off hours.
Your best move: In this case, it's really a matter of your own behavior. "You have to make sure not to abuse that power," says Rosenbaum.
The contents or opinions in this feature are independent and do not necessarily represent the views of Cisco. They are offered in an effort to encourage continuing conversations on a broad range of innovative technology subjects. We welcome your comments and engagement.
We welcome the re-use, republication, and distribution of "The Network" content. Please credit us with the following information: Used with the permission of http://thenetwork.cisco.com/.