BYOD and personal device audit

Why run this

What this checklist is for

Every firm has a policy about personal devices, and in most firms the practice is that a partner in an airport reads a matter email on their own phone.

A control that depends on senior people behaving differently from how they demonstrably behave is not a control.

Run it with

Risk partner

And with

IT lead

And with

A partner who genuinely uses their own phone for work

The checklist

20 checks, in the order we would run them

Tick only what you can genuinely evidence today. An item you intend to do is not an item you have done, and scoring yourself generously here only produces a comfortable number and an uncomfortable project.

Section 1

Reality

What is actually happening, as opposed to what policy states.

The number of personal devices accessing firm data is knownNot estimated. Reported from the platform.
Policy reflects observed behaviour rather than aspirationA policy nobody follows is a liability in a professional negligence context, not a protection.
Partners and senior staff are included in scope, not exemptedThe exemption is usually where the sensitive matters are.
Devices belonging to consultants and contractors are coveredThey access client data under your firm's obligations.
A route exists for somebody to declare a device they were using informallyAmnesty produces a more accurate picture than enforcement does.

Section 2

Protection

What is applied to firm data on a device you do not manage.

App protection policies are deployed rather than requiring full enrolmentProtect the data, not the device. Enrolment is the fight you do not need to have.
PIN or biometric required to open firm applicationsProportionate. An aggressive requirement on a personal phone will be worked around.
Copy and paste from firm applications to personal ones is blockedThis is the everyday leakage path and it is invisible without the control.
Saving firm documents to personal cloud storage is blockedPersonal cloud storage is outside every retention, discovery and confidentiality obligation you hold.
Firm data is encrypted within the application containerSo a compromised device does not mean readable client material.

Section 3

Departure

The scenario the whole arrangement exists for.

Selective wipe is enabled and has been testedTest it on a real device. The departure conversation is much easier when the mechanism is proven.
Wipe removes firm data only and leaves personal contentThis is what makes the arrangement acceptable to partners, and it should be demonstrable.
The leaver process includes personal device de-provisioningIt is routinely missed because the device is not on any asset register.
Access revocation happens within one business day of departureTest it against somebody who left recently rather than assuming.
A record exists showing when firm data was removedYour professional indemnity insurer may ask, and a partner moving to a competitor makes it material.

Section 4

Assurance

Whether you could evidence any of this.

Encryption and protection status is reported, not assumedPolicy says required; the report says applied. Read the report.
Conditional access requires a compliant or protected state for matter contentOtherwise the protection is advisory.
Staff have been told what the firm can and cannot see on their deviceTransparency here materially improves adoption and reduces resistance.
The arrangement has been reviewed by whoever handles your professional obligationsClient confidentiality is a regulatory matter, not only a technical one.
Insurance and client questionnaire answers match the actual positionAn aspirational answer creates a claims problem later.

What your score means

Read this against the number above

These bands are deliberately blunt. The middle band is where most organizations honestly sit, and it is a perfectly reasonable place to proceed from — provided the gaps are written down with owners rather than carried as optimism.

0–59%Significant gaps

Do not proceed yet. More than four in ten items are unaddressed, and the ones that fail here are usually the foundational ones that make everything after them harder.

60–84%Mostly ready, with known gaps

Proceed on a defined scope, with the outstanding items written into the plan as risks with owners and dates. This is the most common honest position.

85–100%Ready

The remaining gaps are small enough to handle during delivery rather than before it. Confirm the unticked items are genuinely minor rather than simply unexamined.

Your score highlights automatically as you tick items above. Nothing is saved, sent or tracked — refreshing the page clears it.

Closing the gaps

If you could not tick these, start here

The four items below are the ones whose absence causes the most trouble downstream. If your unticked items include any of these, they are worth addressing before the rest.

Personal devices unmanaged and uncounted

Start with app protection rather than enrolment. It achieves the security outcome without the fight and can be deployed in days.

Selective wipe untested

Test it on a real device. Discovering it does not work during a partner's departure is the worst possible timing.

Policy does not reflect practice

Rewrite the policy to match observed behaviour and then control it. An unfollowed policy is worse than none in a negligence context.

Status assumed rather than reported

Read the compliance report. The gap between policy and applied state is usually meaningful.

Want a second opinion on your score?

We will assess your current position against what your professional indemnity insurer asks, and demonstrate app protection working on a real personal phone.

Talk through your result Read the related guides We reply to every message within one business day.

Keep going

Related checklists

sharepoint

legalReadiness

Permissions and confidentiality audit

Twenty checks on whether your matter content is reachable only by the people who should reach it — including through search.

May 9, 2026 · 20 checksOpen

What this checklist is for

Run it with

And with

And with

20 checks, in the order we would run them

Reality

Protection

Departure

Assurance

Read this against the number above

If you could not tick these, start here

Personal devices unmanaged and uncounted

Selective wipe untested

Policy does not reflect practice

Status assumed rather than reported

Want a second opinion on your score?

Related checklists

Permissions and confidentiality audit

Tell us what you're trying to fix

Let’s get started on something great

Phone

Email