An enterprise mobility management strategy must be developed to determine how mobile devices will be procured and deployed in mobile first organizations.

Control Type: Administrative

Control Function: Preventive

Description: Once upon a time, organizations used a strictly on-premises, desktop focused network environment that isolated assets to the company facilities. Today however, work environments have become highly mobile, with more flexible, decentralized networks involving remote workers connecting from a variety of external locations and networks. Many organizations are phasing out desktop workstations in favor of laptops and docking stations. These allow employees to work in a classic desktop setup on premises, then disconnect their laptops and take them home for remote purposes.

When planning for endpoint deployments, organizations need to start by defining a strategy for procuring and managing mobile devices. There are several different options, with each one using a different responsibility model and cost sharing strategy.

  • Bring Your Own Device (BYOD): This strategy allows employees to bring their personally owned devices and use them for company work. The employee is in charge of paying for the device and keeping it in good condition. They are also in charge of the underlying operating system. However, in this strategy, the organization will allow access to company resources under conditions acceptable to them. The organization may require employees to enroll the device in Mobile Device Management (MDM) and utilize a separate profile for work use. This strategy has the advantage of providing greater comfort and convenience for employees. However, a badly implemented BYOD solution can create security risks for the organization due to company data being mixed in with non-company devices. If a business decides to embrace BYOD, they need to produce a corresponding strategy for keeping company resources under company IT governance.
  • Corporate Owned Personally Enabled (COPE): This strategy involves the organization purchasing the devices, then providing them to employees for them to use in both workplace and personal capacities. Like BYOD, the organization will usually set standards for the device to ensure security. Employees have near full reign over the use of the device, but the organization can and will step in when a security or severe misconduct issue arises.
  • Corporate Owned Business Only (COBO): This strategy involves devices issued by the organization to employees to be used for strictly business purposes. These devices can be taken home by employees, but policies will be in place to prevent any personal use. This approach grants employees the convenience of being able to take their devices on the move while also safeguarding sensitive company data.
  • Choose Your Own Device (CYOD): This strategy involves the organization allowing employees to pick their own devices. This can be beneficial in environments where different jobs require varying levels of power. The organization may set a ceiling on device price to keep it within budget. When the devices arrive, the organization will usually combine them with any of the above strategies to dictate employee use.