Why protecting corporate mobile devices matters
A company phone is as much an entry point to corporate data as a laptop. What does verifiable protection mean, and where should you start?
At many companies, laptop protection has been in good order for years: encryption, update management, antivirus, a device inventory. With company phones, however, the attitude is often still “it's just a phone”. Yet the device in an employee's pocket now holds company email, the CRM, shared documents and often the authenticator app used to sign in to other systems.
The phone is an entry point
A lost or compromised company phone puts at risk not only the data stored on it, but everything it gives access to. If the phone is the second authentication factor, its protection is part of the entire access chain.
The most common risks
- Loss and theft: the most frequent and most tangible case. The question is not whether it happens, but how quickly the company can respond.
- Outdated patch level: a device running a software version with a known vulnerability is a risk even if it is never lost.
- Rooted or tampered device: if the integrity of the system is compromised, the built-in protection mechanisms cannot be relied on either.
- Mixing of company and personal data: if everything is in one place, it is hard to remove only the company data when someone leaves or a device is lost.
- Unchecked apps: anything can be installed that may access company data.
- SIM swap: a new SIM card inserted into a stolen phone is often the first step towards misuse.
“Hoped-for” vs. “verifiable” protection
Most companies have some kind of rule for phones: screen lock is mandatory, personal apps are discouraged. The question is whether anyone can verify it. Verifiable protection means four things:
- Device inventory: you know exactly how many company devices there are, who has them and in what state.
- Patch level: you see which security update each device is running.
- Integrity: regular checks flag rooted or tampered devices.
- Response time: if a device is lost, you can lock it or wipe company data within minutes.
The four layers of protection
- Device: managed, at a known patch level, with verified integrity.
- Data: encrypted and kept apart from personal data in a work profile.
- Access: only devices in a compliant state can reach company systems.
- Response: lock, wipe, alert – regardless of whether the user can be reached.
NIS2 and GDPR: what can and cannot be claimed?
Both Hungarian Act LXIX of 2024 transposing the NIS2 Directive and Article 32 of the GDPR (security of processing) require appropriate technical and organisational measures. The capabilities of device management – device inventory, patch level, integrity checks, remote lock and wipe, role-based remote support – can help you design and document these measures.
It is important to be clear, though: no device or software guarantees compliance on its own. Which specific measures an organisation needs is determined by its own risk assessment and its auditor. Device protection contributes evidence and a documentable state to that process.
Where to start?
Inventory
Find out how many company phones and tablets there are, who has them, which models and which software level. This alone often comes as a surprise.
Baseline policies
Screen lock, encryption, app rules – centrally and consistently, not by hand on each device.
Patch level
Define the minimum required patch level and track which devices fall behind.
Loss procedure
Write down who must report a lost device, who locks it, and when to wipe the whole device or only the work profile.
8-point self-check list
- Do you know how many company mobile devices are in use, and who has them?
- Can you see the security patch level of each device?
- Would you notice if a device had been rooted or tampered with?
- Could you lock a lost phone within minutes, even if the user cannot be reached?
- Could you wipe only company data without touching personal data?
- Do you centrally control which apps may run?
- Can a non-compliant device be excluded from company systems?
- Could you document all of this for an internal audit or a customer question?
If the answer to several questions is “no” or “I don't know”, it is worth assessing where you stand today. Request a quote – we will help you decide which capabilities you really need.