ISO27001KIT
    Back to all documents
    Annex A & Operational Policies
    policy
    mobile
    HR

    BYOD Policy

    Rules for personal devices accessing company data (Annex A 8.1).

    Failed to load preview.

    About this BYOD Policy

    The BYOD Policy is a ready-to-use ISO 27001:2022 template designed to help organizations document and operate the controls expected by certification auditors. It directly supports Annex A 8.1 of the ISO 27001 Annex A control set.

    Rules for personal devices accessing company data (Annex A 8.1). Use it as the baseline for your ISMS documentation, tailor it to your scope and risk appetite, then maintain it through your normal document-control process.

    What's inside

    • - Pre-written purpose, scope and policy statements
    • - Roles and responsibilities aligned with ISO 27001:2022
    • - Control requirements mapped to Annex A 8.1
    • - Review, approval and version-control sections
    • - Editable Word (.docx) version in the Document Pack

    Who is this for

    • - Companies pursuing ISO 27001:2022 certification
    • - ISMS managers and information security leads
    • - Consultants delivering ISO 27001 implementations
    • - Auditors preparing evidence packs for Stage 1 / Stage 2
    • - SaaS and tech teams formalizing security policies

    ISO 27001:2022 relevance

    • Supports Annex A 8.1 of ISO 27001:2022
    • Contributes to the documented information required by clause 7.5

    How to customise

    • - Insert your organisation name, scope, and document owner.
    • - Adapt scope statements and definitions to your environment.
    • - Align responsibilities with your actual roles and team structure.
    • - Approve, version, and publish via your document control process.

    Evidence auditors may expect

    • - Approved and dated version of the document
    • - Evidence the document is communicated to relevant staff
    • - Records showing the controls described are actually performed
    • - Review history demonstrating the document is kept current

    Auditor may ask

    Q.Who owns the byod policy, and when was it last reviewed?
    Q.How is this document communicated to the people who need it?
    Q.What evidence shows the controls described are operating?
    Q.How is the document updated when scope or risk changes?

    These are realistic questions an external auditor may use to test the control. Your answer must be supported by the evidence listed above.

    Frequently asked questions

    Does ISO 27001 require a BYOD policy?

    If personal devices are used to access organisational information, a BYOD policy is expected under Annex A 8.1 (User endpoint devices) to define the conditions and controls that apply.

    What controls should a BYOD policy include?

    Approval and registration, mandatory MDM or container, OS and patch baseline, encryption, screen lock, separation of personal and corporate data, and the right to remote wipe corporate data.

    Can ISO 27001 certified organisations allow BYOD?

    Yes - ISO 27001 does not prohibit BYOD. It requires the risks to be assessed and treated, and that the controls in the BYOD policy are implemented and evidenced.

    What evidence supports a BYOD policy?

    Signed user agreement, MDM enrolment records, device inventory, the risk assessment covering BYOD, and incident records showing the remote wipe / revoke process has been tested.

    Get the editable BYOD Policy

    This template is included in the ISO 27001 Document Pack for $99 (one-time).