What should organisations do when mobile devices are already fragmented across teams?

When mobile fragmentation starts, treat policy as the control plane

Fragmented mobile ownership becomes a security problem when different teams approve different device types, apps, and exceptions without one common standard. The first task is to define the minimum acceptable baseline for device approval, application approval, monitoring, and exception handling, then make that baseline the same everywhere. That gives you a single control plane for a previously inconsistent fleet.

Fragmentation is usually less about the devices themselves and more about inconsistent decision rights. One team may tolerate personal devices, another may allow unmanaged apps, and a third may have no visibility at all. Standardising policy closes those gaps and creates a clear rule for what is allowed, what is monitored, and what must be brought under management.

Once the policy baseline exists, unmanaged endpoints should be moved into the same operating model rather than left in a separate “temporary” category. If you keep exceptions isolated for too long, they become shadow endpoints with weaker monitoring, weaker enforcement, and ambiguous ownership. The practical objective is to collapse the gap between stated policy and real usage.

Bringing unmanaged endpoints into the same control model

The control model should not depend on which team first adopted mobile technology. A fragmented estate needs a common approach to enrollment, configuration enforcement, app approval, and monitoring coverage so that risk does not vary by department. That typically means aligning MDM or EMM rules, access expectations, and reporting into one shared standard.

Where teams already use different device classes or different support arrangements, the decision is not whether every device must look identical. The decision is whether each device type is assessed and governed against the same security outcomes. A managed corporate phone, a personally owned tablet, and a contractor handset can all exist, but they should not operate under unrelated control assumptions.

This is also where inventory matters. If you cannot say which devices are in scope, who owns them, and which policy they fall under, you cannot reliably enforce consistency. The organisation should be able to identify approved devices, approved applications, and the current exception path for every endpoint category.

Why fragmented mobile estates fail in practice

Fragmentation creates risk because security controls stop being comparable. One team may patch quickly, another may defer updates, and a third may not enforce baseline settings at all. That makes monitoring harder, incident response slower, and policy enforcement uneven across the mobile estate.

It also weakens trust in access decisions. If mobile endpoints are used to reach corporate data or internal services, inconsistent device posture means some sessions are more trustworthy than others. A common control model makes it easier to decide when an endpoint is acceptable, when it needs remediation, and when access should be limited until the device is brought back into compliance.

For organisations that need a broader governance reference for this kind of device and access standardisation, ISO/IEC 27002:2022 Information Security Controls gives a useful control-selection lens, while NIST Cybersecurity Framework 2.0 helps structure governance, protect, detect, and recover activities around the mobile estate.

Where teams are dealing with mobile apps that carry embedded credentials or API keys, the problem can extend beyond device management into secret exposure. In that case, iOS apps leaking hard-coded secrets is a relevant reminder that app governance and device governance need to move together.

Practitioner Guidance

What to prioritise: Start with the simplest common baseline that every team can actually follow, approved devices, approved applications, and monitoring. If the baseline is too ambitious, teams will keep side-stepping it and fragmentation will persist.

What to verify: Verify that every mobile endpoint has a named owner, a known policy status, and a defined remediation path. If a device cannot be placed into one of those states quickly, it is already operating outside the control model.

Common mistake: Treating unmanaged devices as a separate “flexibility” tier is the fastest way to preserve inconsistency. A temporary exception should have an expiry condition, not become an alternate standard.

What good looks like: Teams may still use different mobile form factors, but the organisation can answer the same questions for all of them: what is approved, what is monitored, and what happens when a device falls out of compliance.

Practitioner takeaway: The goal is not to eliminate every mobile variation, it is to make variation governable, visible, and enforceable under one set of rules.

Related resources from NHI Mgmt Group

• How should security teams make NHI best practices usable across the business?
• How should organisations govern access when IAM, PAM, and mobile access are split across teams?
• How should healthcare organisations improve identity and access management for frontline and clinical users across shared devices and mobile workflows?
• How should security teams handle fragmented telemetry across connected vehicles, edge devices, and AI-driven mobility systems?