Security baseline
- Device enrolled in mobile device management before issue
- Passcode or biometric required, with a minimum complexity
- Device encryption enabled
Mobile Device Policy Template
Corporate mobiles get treated as phones rather than as endpoints holding mail, documents, and MFA tokens. This policy gives them an explicit security baseline and the register that proves it is applied.
What you get
- A security baseline enforced through device management
- App installation rules, including sideloading and public store use
- Loss and theft reporting obligations with a response timeline
- A device register tracking compliance state and assignment
How to use this template
- 1
Treat the phone as an endpoint. A corporate mobile usually holds mail, documents, chat history, and often an MFA authenticator. Apply a baseline proportionate to that, not to the device's price.
- 2
Set the minimum OS version and enforce it. Devices on unsupported OS versions receive no security patches. State the minimum, enforce it via conditional access, and plan the refresh before devices fall out of support.
- 3
Make loss reporting fast and blameless. The window between loss and report is your exposure. Give a 24-hour obligation, a simple route, and make clear that prompt reporting carries no penalty. Hesitation is what causes harm.
What's inside
Here's a preview. Unlock the free download to get all 4 sections (3 more below).
Related templates
More free templates IT teams use alongside this one.
IT Policies
Get templateBYOD Policy Template
BYOD policies fail on one question: what exactly happens to someone's personal phone when they leave or lose it. Answering that precisely, in advance, is the difference between a policy people accept and one they quietly evade.
IT Policies
Get templateAcceptable Use Policy Template
An acceptable use policy only does its job if you can prove someone agreed to it. This one pairs clear, enforceable clauses with the acknowledgment register that turns the policy into something you can actually rely on in a disciplinary or legal process.
Asset & Endpoint Management
Get templateIT Asset Inventory Template
Most asset registers die of one disease: nothing in the organisation forces them to be updated. This one is built around the three events that actually change an asset's state (assignment, repair, and disposal), so the register is maintained by the work rather than by an annual audit.
Frequently asked questions
What should a corporate mobile device policy include?
+
Enrolment requirements, a security baseline covering passcode, encryption, minimum OS and update settings, app installation rules, travel provisions, loss and theft reporting obligations with a timeline, and a device register showing compliance state.
How quickly should a lost phone be reported?
+
Within 24 hours, and the policy should state that prompt reporting is never penalised. The exposure window is the time between loss and report, so anything discouraging a quick report increases risk rather than reducing it.
Should corporate phones allow personal use?
+
Most organisations permit it within the acceptable use policy, because prohibition is unenforceable and encourages people to carry two devices and forward work mail to personal accounts. Set the boundary around data handling rather than around personal activity.