A company has adopted a BYOD program. The company would like to protect confidential information. However, it has been decided that when an employee leaves, the company will not completely wipe the…

Revoking cloud server access prevents future data retrieval but does not remove confidential data that may already be cached, downloaded, or synced locally on the personal device.

Whitelisting access to non-confidential information is a preventive measure but does not address confidential data the employee may have already accessed, saved, or copied before the policy was enforced.

An MDM solution with containerization creates a cryptographically isolated corporate partition on the employee's device, keeping all confidential company data, apps, and credentials separate from personal data. Upon termination, administrators can remotely wipe only the corporate container, removing all confidential information without performing a full device wipe that would destroy personal data. This satisfies both the security requirement and the company's decision not to fully wipe personal devices.

Prohibiting local storage is technically impractical for a true BYOD device and would make normal device operation impossible, undermining the purpose of a BYOD program.