BYOD Asset Discovery: How to Track Personal Devices That Reach Company Data

Description and use

The BYOD discovery process reduced 300 raw entries to 187 active personal devices, 142 fully accountable, and 31 with confirmed owners, providing auditors with clear evidence.

Problem

A security questionnaire asked how many personal devices can access customer data, but the asset inventory only listed company‑owned laptops, leaving auditors uncertain about BYOD access.

Outcome

The process turned a noisy identity record set into a clean, accountable inventory of personal devices, enabling compliance with the security questionnaire and establishing a repeatable audit trail.

Workflow

• Decide which company data puts a device in scope
• Pull device evidence from identity, MDM, mailboxes, and network scans
• Clean the list: merge duplicates, match scan results, mark stale, flag shared
• Sort every device: Seen, Attributed, Accountable
• Choose control levels based on data access
• Build lifecycle triggers for ongoing updates

Evidence

The team ended up with about 300 device entries. The asset sheet had 118 laptops.

Source

After two weeks, the team's 300 raw entries came down to 187 active personal devices.

Source