Small Business Device Management: Laptops and Phones

In a small business the laptops and phones that hold customer data, email and banking access are often bought on a credit card, set up by their user and never looked at again. Without an IT department nobody checks whether they are updated, encrypted, locked or still in the hands of the person who should have them, and personal phones that read work email are invisible. This guide shows how a business of roughly 2 to 50 people can manage its devices with tools it probably already pays for: a device register, a short set of required settings, a basic device management service, a clear approach to personal devices, and a simple routine for lost devices and leavers. It is written for owners, office managers and the person who "does the IT", and it lines up with the UK Cyber Essentials requirements so the same work helps with certification.

Key takeaways

Know what you have. A one-page device register (who, what, serial number, operating system, encryption, last update) is the foundation for everything else.
Five settings cover most of the risk. Screen lock, automatic updates, encryption, built-in antivirus and a separate admin account, applied to every work device.
Use the management tool in your subscription. Business editions of Microsoft 365 and Google Workspace include device management that can enforce a screen lock and remove work data from a lost phone.
Personal phones are in scope if they touch work data. Cyber Essentials says so; protect the work apps and data rather than trying to control the whole personal device.
Plan for loss and leavers before they happen. Know who can lock and wipe a device, how quickly, and how to get company devices and data back when someone leaves.

Start with a device register

You cannot protect devices you do not know about. The NIST Cybersecurity Framework 2.0 starts asset management with ID.AM-01, maintaining inventories of hardware, and Cyber Essentials requires every end user device that accesses organisational data or services to be in scope.

Field	Example	Why it matters
Device and serial number	Laptop, 14-inch, serial ABC123	Needed for insurance, police reports and enrolment in management tools
Owner	Company or personal	Decides what you can enforce and wipe
Assigned user	[Name], from [date]	Who to call if it goes missing; what to collect when they leave
Operating system and version	Windows 11, macOS, iOS, Android	Shows whether it still gets security updates
Managed?	Enrolled in device management: yes or no	Shows whether you can lock or wipe it remotely
Encryption	BitLocker or device encryption, FileVault, built in on modern phones	A lost encrypted device is far less serious
Recovery key location	Stored in the management tool or company account	Without it, a locked-out laptop's data is lost
Purchase and end-of-support date	Bought [date], updates until [date]	Plan replacements before devices go unsupported

A spreadsheet is fine for a small team. Once devices are enrolled in a management tool, use its device list instead and review it monthly.

The baseline every work device must meet

These settings come from the NCSC's small organisations guidance on protecting devices and the Cyber Essentials Requirements for IT Infrastructure v3.2 (April 2025). The Cyber Essentials numbers are minimums for certification.

Setting	Requirement	Source	How to apply without IT staff
Device unlock	Biometric, password or PIN; PINs used only to unlock at least 6 characters; no more than 10 guesses in 5 minutes or lock after more than 10 failures	Cyber Essentials v3.2; NCSC recommends a 6-digit PIN or strong password and different codes per device	Enforce through device management, or check each device by hand
Security updates	Automatic updates on where possible; critical, high risk or CVSS v3 7+ fixes within 14 days of release	Cyber Essentials v3.2	Turn on automatic updates; use update rings or deadlines in the management tool
Supported software	All software licensed and supported; remove it when unsupported	Cyber Essentials v3.2; NCSC says to replace devices that no longer get updates	Track end-of-support dates in the register
Malware protection	Anti-malware on Windows and macOS that updates, blocks malware and malicious websites, or application allow listing	Cyber Essentials v3.2	Built-in Microsoft Defender Antivirus and macOS XProtect; phones installing only official store apps
Accounts	Unique credentials per user; separate admin accounts used only for admin tasks; MFA where available and always for cloud services	Cyber Essentials v3.2	Daily use on standard accounts; one admin account per responsible person
Unused software and auto-run	Remove unnecessary accounts, software and services; disable auto-run	Cyber Essentials v3.2; NCSC says delete apps you no longer use	Remove pre-installed trial software at set-up
Encryption	Full disk encryption on laptops; modern phones encrypt when a passcode is set	NIST SP 800-53 SC-28 (protection of information at rest)	BitLocker or device encryption on Windows, FileVault on Mac, with recovery keys held by the business
App sources	Only official stores or websites	NCSC	Restrict app installation on company phones through device management

For laptop-specific settings in more depth, see the Securing Home Computers guide (the same built-in features apply at work) and the Disk Encryption Guide: BitLocker and FileVault.

Choosing a device management approach

Device management tools (often called MDM, mobile device management, or endpoint management) let you push settings, see device status and lock or wipe devices remotely. Microsoft describes two models in Intune that apply to most products: MDM manages the whole device, including settings, security and apps, and lets you wipe a lost or stolen device; MAM, mobile application management, manages only work apps and the data inside them and is typical for personal devices, allowing work data to be selectively wiped without touching personal content.

Option	What it gives you	Good for	Limits
Manual baseline plus register	Settings checked by hand quarterly	Fewer than 5 devices, no budget	No remote wipe beyond the platform's own Find My service; relies on discipline
Google Workspace basic mobile management	On by default; password requirements on mobiles, remote wipe of the work account, device list and activity alerts for Android, iPhone and iPad	Google Workspace businesses with mostly personal phones	Advanced management needed for app management and device audits
App protection policies (for example Intune MAM without enrolment)	PIN to open work apps, block copy and paste to personal apps, selective wipe of work data	Personal phones used for email and Teams or Office	Does not manage the device itself; full wipe requires enrolment
Full MDM for company-owned devices (for example Intune, Google advanced management, an Apple-focused MDM)	Enforced settings, update deadlines, encryption with recovery key escrow, app deployment, remote lock and wipe	Company laptops and phones	Set-up time; needs a careful admin, since the MDM itself becomes a powerful system
Automated enrolment (Windows Autopilot, Apple Automated Device Enrollment through Apple Business, Android Enterprise zero-touch)	New devices enrol themselves at first start-up, so they cannot be used unmanaged	Businesses buying devices through a reseller that supports it	Requires buying through supported channels

Check what your current subscription includes before buying anything new; business tiers of both Microsoft 365 and Google Workspace include some device management. Apple's guide notes that Apple Business Manager is now part of Apple Business. The security of the management tool itself matters as much as the devices: protect its admin accounts with phishing-resistant MFA. See the Mobile Device Management Security Guide for that side.

Personal devices (BYOD)

Cyber Essentials v3.2 puts user-owned devices in scope if they access organisational data or services, and excludes devices used only for native voice, native text or MFA apps. The NCSC says to lock down access to all devices, including personal devices staff use for work.

Decide what personal devices may access: email, calendar and chat on phones is common; files with customer data or banking access may be limited to company devices.
Protect the apps, not the person's phone: app protection policies can require a PIN for work apps, prevent copy and paste into personal apps and wipe only the work data. Microsoft's documentation says management is "centered on the user identity" and personal data is untouched.
Set minimum standards: supported operating system, screen lock, automatic updates and official app stores only.
Write it down: staff should know what the business can see and remove. Use the BYOD Policy Template.
Be honest about the trade-off: the more you restrict, the more staff resist; the less you protect, the more work data sits on unmanaged devices.

Lost and stolen devices

The NCSC notes that phones and tablets leave the office often and are more likely to be lost or stolen. Write down the steps now so anyone can follow them:

Report immediately: staff tell [named person] as soon as they notice, day or night, with no blame for reporting.
Locate and lock: use the management tool or the platform service (Apple Find My, Google Find My Device, Windows Find my device) to locate and lock the device and display a contact message.
Revoke sessions: sign the user out of email and cloud services and reset their password if the device was unlocked or the password may be known.
Wipe when recovery is unlikely: erase company devices; for personal devices, wipe the work account or work app data. Apple notes that an offline device is erased the next time it connects and that Activation Lock stays on to protect it.
Record and report: update the register, record the time line and whether the device was encrypted, report theft to the police and your insurer, and consider whether personal data was at risk. In the UK, a personal data breach that is likely to result in a risk to individuals must be reported to the ICO within 72 hours; an encrypted, locked device usually lowers the risk.

For the wider response, see the Small Business Incident Response Guide.

Joiners, leavers and disposal

Joiners: issue devices already enrolled and in the register; set up a standard account and require MFA on first sign-in.
Leavers: collect company devices on the last day, disable accounts the same day, remove work data from personal devices through selective wipe, and transfer files they own. Check the register so nothing is missed.
Reuse: reset devices to factory settings before reissuing, and remove them from the previous user's accounts so Activation Lock or account locks do not block the next user.
Disposal: erase securely before selling, recycling or returning leased equipment (NIST SP 800-53 MP-6 media sanitisation). The NCSC device security guidance has a section on erasing devices.

Where identity fits

Devices are only as secure as the accounts on them. A laptop with a shared local admin password, or a phone signed into a former employee's account, is an identity problem. Use one standard account per person, one separate admin account per responsible person, MFA on every cloud service as Cyber Essentials requires, and the management tool's ability to rotate or randomise local admin passwords where available (for example Windows LAPS). Management tools also connect to other systems with service credentials and certificates; protect the admin accounts and any API tokens for the tool as privileged. See the Small Business Identity and Access Security Guide.

A rollout plan

Month 1, week 1: build the register from purchase records, the Microsoft 365 or Google Workspace device list and a quick staff survey of which personal devices read work email.
Week 2: fix the five baseline settings by hand on every company laptop, starting with the owner's and finance devices. Store all recovery keys in the company account.
Week 3: turn on the device management included in your subscription. Pilot with two or three willing users for a week, check that email, printing and line-of-business apps still work, then extend.
Week 4: apply app protection or basic management to personal phones that read work email, with the BYOD policy explained first. Use report-only or audit modes where the tool has them before enforcing.
Month 2: set update deadlines (14 days for critical and high fixes), add a compliance rule that blocks access from unencrypted or out-of-date devices, and write the lost device and leaver steps.
Ongoing: monthly review of the device list, quarterly check of the baseline on a sample of devices, yearly replacement planning.

Rollback: keep policies in small groups so a setting that breaks an app can be removed from the pilot group without affecting everyone; never wipe a device as part of a test.

Measuring whether it is working

Coverage: share of devices in the register that are enrolled or under app protection, target 100% of devices that access work data.
Patch compliance: share of devices with critical and high updates installed within 14 days.
Encryption: share of laptops encrypted with recovery keys held by the business.
Unsupported devices: number of devices past end of support, target zero.
Lost device response time: time from report to lock or wipe, target under one hour.
Leaver completeness: share of leavers whose devices and work data were recovered on their last day.

Framework mapping

Control	Cyber Essentials v3.2 area	NIST CSF 2.0	NIST SP 800-53 Rev. 5
Device register	Scope (all end user devices)	ID.AM-01	CM-8
Baseline settings, screen lock, remove unused software	Secure configuration	PR.PS-01	CM-6
Updates within 14 days, unsupported software removed	Security update management	PR.PS-02	SI-2
Antivirus or allow listing	Malware protection	DE.CM-09	SI-3
Separate admin accounts, MFA	User access control	PR.AA-05	IA-2(1)
Mobile device rules and BYOD	Scope (BYOD)	PR.AA-05	AC-19
Encryption at rest, secure disposal	Not a Cyber Essentials requirement	PR.DS-01	SC-28, MP-6

Common failure patterns

No register: nobody knows how many devices exist, so the lost one is only noticed when someone needs it.
Everyone is an admin: staff use administrator accounts every day, so any malicious download controls the device.
Recovery keys on the user's personal account: when they leave, the business cannot unlock the laptop.
Personal phones ignored: work email sits on phones with no screen lock and no way to remove it when someone leaves.
Old devices kept in service: laptops and phones that no longer receive security updates stay in daily use.
Management tool admin without MFA: one stolen password could wipe or reconfigure every device.

Practitioner checklist

Create a device register covering company and personal devices that access work data.
Apply screen lock, automatic updates, encryption, antivirus and separate admin accounts to every work device.
Install critical and high security updates within 14 days and replace unsupported devices.
Turn on the device management included in your Microsoft 365 or Google Workspace subscription.
Protect work apps on personal phones with app protection or basic management, under a written BYOD policy.
Store laptop recovery keys in a company-controlled account.
Write and test the lost device steps: report, locate, lock, revoke sessions, wipe, record.
Collect devices and remove work data on every leaver's last day.
Protect the management tool's admin accounts with phishing-resistant MFA.

Small Business Device Management Guide: Secure Laptops and Phones Without an IT Department