A Complete Guide to Issuing Portable Devices to Staff

In the modern workplace, the issuance of portable devices to staff demands careful consideration and robust management. From custodianship responsibilities to cybersecurity measures, companies must implement comprehensive strategies to ensure the effective, secure, and responsible use of devices by employees. This guide provides an in-depth overview of key considerations and best practices for managing portable devices within a company setting.

Establish clear device policies to set expectations

What is a work device policy?

A work device policy, also known as a device usage policy or a technology usage policy, is a set of guidelines and rules established by an organisation to govern the appropriate use of devices provided to employees for work-related purposes. This policy outlines the rights, responsibilities, and expectations regarding the use, maintenance, and security of company-issued devices, such as laptops, smartphones, tablets, and other electronic equipment. You can view and download a template policy here

This is important to get right as it sets clear guidelines for employees to follow and avoids many of the common problems which can cause unnecessary friction with staff.

What should a work device policy contain?

The key components typically included in a work device policy are:

1. Purpose and Scope: The policy should begin by stating its purpose and scope, clarifying that it applies to all employees who are provided with company-owned devices or who access company systems from personal devices for work-related activities.

2. Device Ownership: The policy should specify that the devices provided by the company are the property of the organisation and are intended for business use. It should outline employees' responsibilities for the care and safekeeping of these devices.

3. Acceptable Use: Clear guidelines should be established regarding the acceptable and unacceptable use of company devices. This may include restrictions on accessing inappropriate content, engaging in personal activities during work hours, or using devices for illegal purposes.

4. Security Measures: The policy should outline security measures that employees are required to follow to protect company data and devices. This may include instructions for creating strong passwords, installing security software, enabling encryption, and reporting lost or stolen devices promptly.

5. Data Protection: Guidelines should be provided for handling sensitive company information on devices, including data encryption, secure file storage, and restrictions on sharing confidential information with unauthorised individuals or external parties.

6. Software and Application Usage: The policy should address the installation and use of software and applications on company devices. It may specify approved software and applications for work-related tasks and prohibit the installation of unauthorised or unapproved software that could pose security risks.

7. Bring Your Own Device (BYOD) Policy (if applicable): If employees are permitted to use personal devices for work purposes (BYOD), the policy should outline the requirements and restrictions for BYOD usage, including security measures, data protection protocols, and reimbursement policies.

8. Consequences of Policy Violations: The policy should clearly outline the consequences of violating the terms of the policy, including disciplinary actions that may be taken in case of non-compliance. This may include warnings, suspension of device privileges, or termination of employment, depending on the severity of the violation.

9. Policy Acknowledgement: Employees should be required to acknowledge receipt and understanding of the policy. This may involve signing a written agreement or electronically acknowledging the policy through an online platform. Something which users of Workforce Wisdom can do through the platform.

10. Policy Review and Updates: The policy should specify how and when it will be reviewed and updated to reflect changes in technology, regulations, or company policies. Regular reviews ensure that the policy remains relevant and effective in addressing evolving security risks and technological advancements.

Overall, a work device policy serves to promote responsible and secure usage of company-issued devices, protect sensitive information, and mitigate potential risks associated with technology usage in the workplace. By establishing clear guidelines and expectations, organisations can safeguard their assets, maintain compliance with regulatory requirements, and foster a productive and secure work environment.

Policy on Acceptable Use

Establishing a policy on acceptable device usage sets clear expectations for employees regarding appropriate conduct and responsibilities. This policy should outline guidelines for using company devices for work-related purposes, as well as restrictions on personal use, accessing inappropriate content, or engaging in activities that could compromise security or productivity. Communicating expectations upfront promotes responsible device usage and mitigates potential risks.

Custodianship of Devices

Devices issued to staff are then under the custody of that staff member, and companies need to be clear on the rules and expectations.

Firstly the company should have a robust system which tracks the asset from purchase through to disposal, small companies can achieve this using spreadsheets but this soon becomes difficult to keep accurate.

It is a good idea to keep photos of the asset before it is issued to staff to ensure that there is no dispute as to its physical condition later on, this is a handy feature in WorkForce Wisdom.

Generally speaking, equipment issued to employees is the responsibility of the owner of the equipment unless expressly agreed otherwise between the employee and employer. This means that unless you have a contract which says differently, damage (even intentional damage) cannot be claimed off the employee. This may come as a surprise to some so planning ahead may be required.

While it would be best to have an agreement on the cost of damage to be in the contract of employment, it is also feasible to have a separate agreement signed by both parties. As with all employment law, the terms must be fair and reasonable to be able to enforce this. Don't for example make the employee liable for reasonable wear and tear.

Tracking Depreciation of Devices

Effectively managing assets requires tracking the depreciation of devices over time. By monitoring the value of devices as they age and assessing their remaining useful life, organisations can make informed decisions regarding replacements or upgrades. Implementing asset management software or systems facilitates accurate depreciation tracking, enabling companies to optimise device investments and minimise financial risks.

Doing this accurately can help your accountants and ensure that they are able to write down or write off lost or damaged equipment sooner and maximise any tax relief.

Health and Safety Considerations

When dealing with portable electrical devices, health and safety considerations are paramount. The Health and Safety at Work Act requires that all devices supplied for use at work or home are supplied in a safe condition. Worn-out or damaged devices pose risks to users, including electrical hazards and potential malfunctions. To mitigate these risks, companies should implement regular inspections and maintenance protocols. Additionally, employees should receive training to recognise signs of wear and damage, ensuring that issues are reported promptly and addressed effectively.

Preventing Unauthorised Software Installation

Safeguarding company devices and data necessitates preventing employees from installing unapproved or risky software. Granting administrative control to employees can compromise security and stability. Instead, companies should configure devices with restricted user accounts, limiting permissions to install software. This ensures that only authorised applications are installed, reducing the risk of malware infections and system instability. Admins can log in remotely if needed to install the required software.

Protective Carrying Cases

Providing employees with protective carrying cases is essential for safeguarding devices against physical damage, and should be considered as well as buying just the device.

If employees are expected to provide their own then they may be tempted to skimp and use unsuitable cases.

Padded cases offer an additional layer of protection against impacts, spills, and other accidents. Investing in high-quality cases tailored to specific device models prolongs their lifespan and minimises repair or replacement costs, ultimately contributing to cost-efficiency and device longevity.

Installing Anti-Virus Software and Establishing Policies

Maintaining robust cybersecurity measures is crucial for protecting company devices and sensitive data from malicious threats. Installing anti-virus software on all devices helps detect and mitigate malware, viruses, and other cyber threats. Additionally, companies should establish clear policies outlining the importance of regularly updating anti-virus software to ensure optimal protection against evolving threats.

Anti-virus though should be one of many layers of protection, educating staff on the risks of malicious attacks and the vectors used in such attacks also needs to be addressed.

Encryption for Data Security

Encrypting laptops or other devices is essential for safeguarding sensitive information against unauthorised access or theft. Encryption scrambles data, making it unreadable without the appropriate decryption key, thereby protecting it from potential breaches. Companies should assess the sensitivity of their data and implement encryption protocols accordingly to ensure compliance with regulatory requirements and protect confidential information. Making use of biometric keys gives great security without employees having to remember many passwords (and the risk then of them writing them down).

Remote Access Software for Troubleshooting

Providing employees with remote access software facilitates efficient troubleshooting and support, particularly in if the employee works full or part-time remotely. Remote access tools enable IT personnel to diagnose and resolve technical issues on employees' devices remotely, minimising downtime and disruptions to productivity. Implementing secure remote access solutions ensures that technical issues can be addressed promptly and effectively, regardless of employees' location.

Balancing Monitoring Software and Privacy Concerns

While monitoring software can enhance device security and compliance and may be a information security requirement for many companies, it also raises privacy concerns among employees. To address this issue, companies should be transparent about the use of monitoring software and establish clear policies regarding its implementation. By communicating the purpose and scope of monitoring activities, addressing privacy concerns, and obtaining employees' consent where necessary, companies can strike a balance between device security and privacy rights.

In conclusion

Issuing portable devices to staff requires careful planning and implementation of comprehensive management strategies. By considering custodianship responsibilities, cybersecurity measures, health and safety considerations, and establishing clear policies, companies can ensure the effective, secure, and responsible use of devices by employees, ultimately contributing to productivity, efficiency, and data protection within the organisation.

Workforce Wisdom can help you track the whole lifecycle of company assets, asking employees to periodically update the condition, report damage, loss or theft and remind you when they need to be replaced.