Within a large organization, the corporate security policy states that personal electronic devices are not allowed to be placed on the company network. There is considerable pressure from the…

Allowing only executives to use personal devices without a policy review creates an undocumented exception that is inconsistent, unauditable, and difficult to enforce or expand in a controlled manner.

Security policies are living documents that must be reviewed and updated when business needs change, especially when pressure comes from authoritative stakeholders like the board of directors. Reviewing the policy allows the organization to formally assess risk, define acceptable-use conditions for personal devices - such as requiring MDM enrollment - and document the new controls, balancing both security and usability in a governed, repeatable way.

Refusing all personal devices ignores a legitimate business requirement from the board and fails to balance organizational security with operational usability needs.

Restricting to centrally manageable devices is a sound technical control, but implementing it without formally revising the policy leaves the organization operating outside its own documented security framework.