For many small businesses, the smartphone has quietly become one of the most important computers in the company. Staff use phones and tablets for Microsoft 365 email, Teams, cloud files, banking approvals, password managers and multi-factor authentication. Yet mobile devices are often given far less attention than laptops.
That matters because a lost, stolen or poorly secured phone can provide access to far more than contacts and photographs. As part of Cyber Awareness Month, here are seven practical checks Sussex SMEs can make without turning mobile security into a major project.
1. Use a proper screen lock
Every phone or tablet that accesses business information should have a strong PIN, password or biometric lock. A four-digit PIN is better than nothing, but longer codes are harder to guess and provide better protection if a device is lost.
Face recognition and fingerprints can make stronger security less inconvenient for staff. Also check the automatic lock time. A device left unlocked for a long period on a desk, train or café table defeats much of the protection.
2. Keep phones and tablets updated
Mobile operating systems and apps receive security updates just like Windows PCs. Delaying them can leave known vulnerabilities open long after a fix is available.
Enable automatic updates where practical and make sure older devices are still receiving security support from the manufacturer. A phone may continue working perfectly well after official support ends, but that does not mean it remains suitable for business use.
3. Know which devices can access company data
If staff can add their work account to any personal phone, the business can quickly lose track of where its information is being accessed. That becomes particularly awkward when somebody leaves, loses a device or replaces their phone.
Microsoft 365 businesses can use device and application management controls to set rules around access. Depending on the requirement, this can range from managing a company-owned device to protecting only the business data and applications on a personal phone.
4. Protect business apps and data separately
Bring-your-own-device does not have to mean taking complete control of an employee’s personal phone. Technologies such as Microsoft Intune app protection policies can help keep company information within approved applications and apply controls to business data.
For example, an organisation may restrict copying company information into personal apps or require an additional PIN before opening business applications. The aim is to protect company data without unnecessarily interfering with personal content.
5. Be careful with public Wi-Fi and charging
Mobile working often means hotels, cafés, airports and shared workspaces. Public Wi-Fi should be treated as an untrusted network. Staff should avoid bypassing browser security warnings and should be cautious about unfamiliar networks with names that imitate the venue.
Mobile data is often a simple alternative when the Wi-Fi cannot be trusted. Staff should also avoid unknown public USB charging connections where possible. Using their own charger and mains adapter removes another unnecessary variable.
6. Plan for a lost or stolen device
A mobile security plan should answer a simple question: what happens if a phone disappears today? Staff need to know who to contact, and the business needs a way to assess what the device could access.
Company-managed devices may support remote locking or wiping. Microsoft 365 sessions can also be revoked and passwords reset where appropriate. Acting quickly is important, particularly when the missing phone is also used to approve MFA prompts.
7. Treat MFA apps as sensitive
Authenticator apps improve account security, but they also make the phone itself part of the authentication process. A compromised or poorly protected device can therefore affect several business accounts at once.
Staff should never approve an unexpected authentication request simply to make it disappear. If prompts arrive when they are not signing in, that should be treated as a warning and reported. Recovery methods should also be documented so the business is not dependent on one person’s old or missing handset.
Mobile security should be part of normal IT management
Phones and tablets are no longer peripheral devices. If they can open company email, access files or approve sign-ins, they form part of the business IT environment and should be treated accordingly.
The practical approach is to understand which devices have access, keep them supported and updated, protect company data, and have a clear response when equipment is lost.
ML Services helps businesses across Sussex manage Microsoft 365, devices and everyday cyber security. If you are unsure what company information staff can currently access from their phones or tablets, contact ML Services for a practical review.