A sampling of BYOD user policies

Here are several actual BYOD policies that you can use as the framework for your own policy

Just say the words "bring your own device" and IT staffers start to rub their foreheads. Allowing users to attach their consumer devices, including smartphones and tablets, to the network might seem like a bad idea, but with a clear user policy that is re-signed annually, you can reduce a lot of organizational risk.

Make sure to include language about which platforms you support, whether or not you reimburse for various charges, what state the device must be in (i.e. not rooted or jailbroken) and what applications can and can't be used while on the network.

Here are a few samples of BYOD policies to help guide you. For a longer discussion of BYOD policies, check out this white paper from the SANS Institute. 

Page 4 of 7

2. PURPOSE

2.1 The purpose of this document is to: (1) define employee eligibility for company-liable mobile devices; (2) establish an employee-owned smartphone alternative; (3) define the responsibilities, guidelines, and terms of use for employee-owned smartphones configured for company data use; and (4) define the enrollment procedure.

3. SCOPE

3.1 This document applies to employees who wish to receive company email/calendar/contact data on a personal mobile device.

3.2 Personal smartphones referenced in this document are limited specifically to smartphones running Apple iOS (iPhone) 4 or higher and Android version 2.2 or higher.

3.3 Employees currently using Blackberry devices and who wish to continue using them may do so. New, eligible employees wishing to use a company-owned Blackberry device may also do so.

4. REFERENCES

4.1 POL-3148 General Information Technology Security Policy

4.2 Employee Handbook use of Internet and Electronic Communications Systems

5. RESPONSIBILITIES

5.1 Information Technology Responsibilities

5.1.1 Information Technology (IT) is responsible for configuring and supporting the Employee-Owned Smartphone Program user's smartphone to receive and access company email, calendar, and contact data.