TOOLBOX · DOWNLOAD
Smartphonepolicy as atemplate.
Anyone who allows smartphones or tablets to be used for work data needs a policy first; in IT-Grundschutz, the BSI requires it as basic requirement SYS.3.2.1.A1. This template contains model text with placeholders for company devices and, as a variant, for personal devices (BYOD): approval, minimum requirements for updates, screen lock, and encryption, apps, loss and theft, return upon departure. It shows how work and personal data can be separated with app protection policies or a work profile without managing the entire personal device, and what IT can and cannot see in the process.
Free PDF · Template
Smartphones and Tablets: Policy for Company and Personal Devices
- Topic
- Security Basics
- Format
- PDF, A4
- Length
- 12 pages
- Size
- 149 KB
- Updated
- Oct 25, 2026
- Sources
- 18
- Usage
- Adaptation for your own use permitted; redistribute unchanged
WHO IT IS FOR
Who This
Is for.
Model text with placeholders for company devices and BYOD, minimum requirements based on BSI SYS.3.2.1 and NIST SP 800-124, implementation with Microsoft Intune.
- IT management and administrators who approve and secure company and personal devices for email, chats, and files
- HR departments that coordinate use, loss, and departure with the employment contract, data protection, and the works council
- Executive management of small and medium-sized companies that approves the policy and is responsible for it
9 SECTIONS
What Is
Inside.
- 01
What the policy is for
What BSI and NIST require of a policy for smartphones and tablets and how binding this is.
- 02
Company device or personal device: the variants
Which operating models exist, who owns the device and the data, and how company data can be separated on personal devices.
- 03
What IT sees on personal devices
Which data Intune, according to Microsoft, never, always, or only under certain circumstances sees, and what HR and the works council need to clarify.
- 04
Minimum requirements for every device
Updates, screen lock, encryption, apps, and interfaces, with the citation in IT-Grundschutz.
- 05
Implementation with Microsoft Intune and Entra ID
Licenses, app protection policy, Conditional Access, and enrollment in four steps.
- 06
Loss, theft, and departure
What to do immediately, which wipe action suits which device, and what happens upon departure.
- 07
Model text, part 1: scope, approval, and minimum requirements
Sections 1 to 5. Replace everything in square brackets and choose variant A or B.
- 08
Model text, part 2: personal devices, loss, and return
Sections 6 to 10, Annex 1 on approved apps, and the acknowledgment for signature.
- 09
Checklist: introducing the policy
Ten steps from taking stock to regular review.
EXCERPT
Model text, part 1: scope, approval, and minimum requirements
Replace the placeholders in square brackets, choose one option where alternatives are separated by |, and delete what does not apply; in variant A (company devices only), § 6 is omitted. Numbers such as [5] minutes are TOMORIS suggestions ([30] days offline is Microsoft's value from level 2); rules without a citation are organizational additions by TOMORIS. Coordinate the text with data protection, HR, and, if there is one, the works council.
- § 1 Purpose and scope
- This policy governs the use of smartphones and tablets for work at [Company]. It applies to all employees and [external persons, e.g., temporary agency workers], to company devices, and to every device used to access work emails, files, chats, or applications. [Name, role] is responsible; the point of contact is [IT team, contact] (SYS.3.2.1.A1).
- § 2 Approved devices
- Variant A: Work data may only be processed on company devices that [Company] has procured and enrolled in [MDM, e.g., Microsoft Intune]. Variant B: In addition, personal devices are permitted if they meet § 3 and are integrated in accordance with § 6; [rules on costs and phone plan]. Approved are [operating systems and minimum versions] (SYS.3.2.2.A2).
- § 3 Minimum requirements
- Every device with work data still receives security updates from the manufacturer; you install offered updates within [7] days. A passcode of at least [6] digits protects the device; it locks after no more than [5] minutes and shows no preview of confidential messages on the lock screen. Biometrics only after approval by [IT team]. Storage is encrypted; rooting or jailbreaking is prohibited. Devices that do not meet these requirements receive no access (SYS.3.2.1.A4, A5, A10, A11, A18).
- § 4 Apps and cloud services
- On company devices, you install apps only from [the Apple and Google app stores | the Company Portal]. You edit work data only in the apps listed in Annex 1 with your company account and store it only in [OneDrive for Business, SharePoint]; private cloud storage, messengers, and email accounts are not permitted for this. Apps receive only the necessary permissions, for example for camera, microphone, or location (SYS.3.2.1.A2, A6, A8).
- § 5 Personal use of company devices
- [Company devices are for work purposes only. | Personal use is permitted to a limited extent, personal apps only from the official app stores.] The device and company data remain the property of [Company]. You back up personal data yourself; in the event of loss and upon return, the device is wiped completely. You do not change management software or security settings (SYS.3.2.1.A10).
SOURCES
Supported
by Sources.
- BSI IT-Grundschutz Compendium, Edition 2023 (complete PDF) (opens in a new tab)Chapter on the structure of the modules and modal verbs; accessed October 25, 2026
- BSI IT-Grundschutz, Edition 2023: SYS.3.2.1 General Smartphones and Tablets (opens in a new tab)1.3, 2.9, A1 to A8, A10, A11, A16, A18, A32; accessed October 25, 2026
- BSI IT-Grundschutz, Edition 2023: SYS.3.2.2 Mobile Device Management (opens in a new tab)1.3, 2.4, A1, A2, A4, A6, A17, A20, A22; accessed October 25, 2026
- NIST SP 800-124 Rev. 2: Security of Mobile Devices in the Enterprise (opens in a new tab)3.1.2, 3.1.11, 3.1.13, 4.2.2, 4.3.3, 4.3.6, 4.3.10 to 4.3.12, 5.1.2, 5.1.3, 5.3.4.2, 5.3.6, 5.5
- Microsoft Learn: App protection policies overview (opens in a new tab)Benefits, devices without enrollment, requirements, wipe
- Microsoft Learn: Data protection framework using app protection policies (opens in a new tab)Level 1 and 2, conditional launch; accessed October 25, 2026
- Microsoft Learn: What information can my organization see? (opens in a new tab)Never, always, and possibly visible; as of August 20, 2026
- Microsoft Learn: Apple user enrollment in Intune (opens in a new tab)Methods, settings, limitations; as of August 20, 2026
- Microsoft Learn: MAM and personally owned work profiles (Android) (opens in a new tab)Privacy, scenarios, summary; as of August 19, 2026
- Microsoft Learn: App-based Conditional Access with Intune (opens in a new tab)Licenses, roles, how it works; as of August 20, 2026
- Microsoft Learn: Migrate approved client app to app protection policy (opens in a new tab)Read-only from June 30, 2026, policy for mobile devices; as of June 1, 2026
- Microsoft Learn: Retire device action (opens in a new tab)Platforms, user experience; as of August 20, 2026
- ArbVG, current daily version in the RIS (opens in a new tab)§ 96 para. 1 no. 3, § 96a para. 1 no. 1 and para. 2; accessed October 25, 2026
- AVRAG, § 10 Control measures, RIS (opens in a new tab)§ 10 para. 1; accessed October 25, 2026
- Regulation (EU) 2016/679 (GDPR), EUR-Lex (opens in a new tab)Art. 5(1)(c), Art. 13(1) and (2), Art. 33(1) and (5)
- Implementing Regulation (EU) 2024/2690, EUR-Lex (opens in a new tab)Annex points 12 and 12.5; applicable under § 2 NISV 2026
- NISG 2026, § 32 Risk management measures, RIS (opens in a new tab)§ 32 para. 4 lit. i, valid from October 1, 2026; accessed October 25, 2026
- NISV 2026, BGBl. II No. 290/2026, RIS (opens in a new tab)§ 2, promulgated on October 1, 2026
This template must be adapted to your company, your devices, and your MDM and does not replace legal advice, in particular not on the ArbVG, AVRAG, and GDPR; the statutory text in its current version is authoritative. IT-Grundschutz and NIST are recommendations, not legal obligations. Microsoft features, names, menus, and licenses may change.
TOOLBOX
Explore
Further.
- Kostenlos
NIS2 applicability check (German)
Am I affected? In 3 minutes
Check Now Microsoft Intune
How Intune manages Windows PCs, Macs, smartphones, and tablets via the cloud: enrollment, configuration profiles, and compliance policies.
Learn MoreConditional Access
How Conditional Access checks sign-ins by person, device, location, and risk and allows, restricts, or blocks access.
Learn MoreIT security policy
Information security guideline and eight basic rules for all employees as a template with placeholders.
Learn More
SECURITY BASICS
More on
This Topic.
- PDF
Password Policy
Length instead of mandatory special characters, changes only on suspicion, blocklist, and MFA: a password policy to adapt, with an old-versus-new comparison and a checklist for Microsoft Entra ID.
View - PDF
IT Security Policy
Model text with placeholders for the information security policy and eight basic rules for all employees, aligned with BSI IT-Grundschutz, the NISG 2026, and the NISV 2026.
View - PDF
Phishing Cheat Sheet
Warning signs with ways to check them, CEO fraud, QR codes, calls and MFA requests, immediate steps after a click, and the reporting channels in Austria: compact, ready to share and post.
View
YOUR NEXT STEP
From Paper
to Practice.
We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.