Personal devices at work: define the boundary before an incident
A BYOD register should connect technical controls, employee expectations and the cyber policy’s actual insured perimeter.
Ownership is not the same as business use
An employee's personal phone may receive work authentication codes, while a private laptop may occasionally open company documents. Those uses do not automatically make the whole device company property or bring every loss within a cyber policy. Checked on 17 October 2026, this dossier focuses on bring-your-own-device boundaries rather than remote access in general. List the actual device, owner, permitted work use and business data accessible from it. A policy declaration that all endpoints are managed needs to match reality. Informal permission from a manager is not a substitute for an agreed security process or a verified insurance definition.
Build the rule around a realistic device inventory
The OFCS guidance on secure remote access explicitly includes clear management of private devices among the relevant technical and organisational measures. Its mobile-work guidance recommends controls such as device access protection, locking screens and supported systems. Translate those principles into an inventory your team can maintain. Record who approves access, which updates are required, whether business information stays in an approved workspace and who responds to a lost device. Do not collect employees' private content to prove compliance. If the company cannot reasonably manage the proposed arrangement, consider issuing a company device rather than writing a rule that nobody can implement.
A hypothetical split between repair and business recovery
Imagine a personally owned laptop used with permission for client work. An incident produces an illustrative CHF 900 hardware repair bill and CHF 4,000 of proposed business-data investigation costs. These amounts are invented, and neither is assumed insured. Ask whether the policy's definitions include the relevant device and data, what incident-response approval is required and whether hardware replacement belongs to another arrangement. A company-data incident can raise different questions from damage to the employee's own machine. Keep those cost categories separate before authorising an external technician, while following urgent containment instructions from the designated IT response contact.
Agree support and privacy expectations in advance
Explain what the business can configure, monitor, restrict or remove, and have IT, HR and appropriate advisers check the arrangement. Do not assume that a general permission to work from a personal phone authorises unrestricted remote wiping of private photographs and messages. Ask whether a business-only container or selective access removal is technically available and suitable. Define how evidence will be preserved and how an employee can report a problem without delaying through fear of losing private data. A written policy is useful only when its instructions are understandable and the team has a practical way to follow them on the devices actually used.
Connect the register to the insurer's questions
Before renewal, compare the device inventory with the proposal form and policy definitions of systems, data, ownership and authorised use. Ask about personally owned devices, employee equipment costs and incident services separately, and obtain written clarification for material uncertainty. Keep the organisation's declared controls accurate; do not answer yes to device management solely because a policy document says it should exist. Review exceptions when roles or equipment change. Clearwise can help organise the insurance questions and supporting evidence. IT professionals determine suitable controls, competent advisers address privacy and employment issues, and the insurer confirms the contractual perimeter rather than a generic BYOD label.
Sources and further reading
Original Clearwise analysis. External reporting provides context; rules and contract terms must be verified with the competent authority or provider. Some press articles may require a subscription.
Apply this to your situation
Compare your actual documents and clarify what matters before making a commitment.
Request a free consultationGeneral guidance, not a binding quote or personalised legal, tax or investment advice. Examples are hypothetical and results are not guaranteed.
