Contents
Short answer
Encrypted, up-to-date devices without everyday admin rights are the baseline. Once several people use devices – including personal phones for work email – mobile device management helps apply rules consistently and lock lost devices.
Why does this matter for small businesses?
Lost laptops, outdated phones and working with admin rights are typical weaknesses of small businesses. Without an overview nobody knows which devices hold company data and whether they still get updates.
What does it include?
Device encryption
Data stays unreadable after loss. Included in all common systems; store recovery keys separately.
Basic
Patch management
Updates for system, applications and firmware, automatic or on a fixed rhythm.
Basic
Admin rights and least privilege
Use standard accounts day to day; admin rights only for installation and management, via separate accounts.
Basic
MDM
Central setup, policies (lock, encryption, updates), app distribution and remote lock.
Useful as IT grows
BYOD (bring your own device)
Personal devices used for work. A separation helps: company data in a managed area, personal data stays personal. Agree rules in writing beforehand.
Useful as IT grows
Lost devices and remote wipe
Lock and, if needed, wipe remotely. With BYOD usually only the company area, not the whole device.
Useful as IT grows
What does it protect against?
- Data access after loss or theft
- Exploitation of known vulnerabilities
- Spread of malware via admin rights
What does it not protect against?
- Phishing and payment fraud
- Devices never enrolled in MDM
- Data stored outside managed apps
Which basic measures are often enough?
- 01Encryption and screen lock on every device
- 02Automatic updates
- 03Standard accounts day to day
- 04A list of all devices holding company data
When does a more advanced solution make sense?
MDM is worth it from several employees, with BYOD or when devices regularly leave the office. With many devices, central patch reporting also helps. MDM is sometimes already included in office licences.
Common mistakes
- Still using devices without updates for company email
- BYOD without rules on data deletion
- One shared admin password for all devices
- Recovery keys stored only on the device itself
Checklist
- All devices encrypted and locked
- Updates running
- Nobody works as admin day to day
- BYOD rules in writing
- Procedure for lost devices known
Frequently asked questions
May the business wipe a personal phone?
This should be agreed in writing beforehand. Usually only the managed company area is wiped. For questions on employee rights, legal advice is sensible.
When is MDM worth it?
Usually from a handful of devices or as soon as personal devices hold company data.
Sensible next step
List every device holding company data and check encryption and updates.
Sources
- Bundesamt für Sicherheit in der Informationstechnik (BSI)
- CISA – Cybersecurity and Infrastructure Security Agency
- NIST Cybersecurity Framework
Checked on 6 Oct 2026.
General orientation – does not replace an individual security review, legal or data-protection advice.