Mobile Device Security for Small Business: Protecting Phones and Tablets

Mobile Devices Are the New Attack Surface

Smartphones and tablets have become primary business tools for most small business employees — used for email, cloud storage access, customer communication, payment processing, and remote system access. They are also among the least secured devices in most small business environments. Unlike laptops and desktops where security software and policies are standard, mobile devices often operate with minimal controls, personal and business data mixed together, and no central management oversight.

The consequences are real. A lost or stolen smartphone with access to business email, customer data, or financial applications is a data breach. A compromised mobile device used to access your cloud systems is an entry point for attackers. Mobile phishing attacks — delivered via SMS, WhatsApp, and social media — are now more common than email phishing in some industries. This guide covers the specific controls that make mobile devices safe for business use.

The Core Mobile Security Controls

Screen Lock and Strong PIN or Biometric

Every device used for business must have a screen lock enabled with auto-lock after no more than 5 minutes of inactivity. A 6-digit PIN is the minimum — longer alphanumeric passcodes are stronger. Biometric unlock (fingerprint or Face ID) is acceptable as a convenience layer but should be backed by a strong PIN. Simple 4-digit PINs and swipe patterns are inadequate for devices containing business data.

Full Device Encryption

Modern iOS and Android devices encrypt storage by default when a screen lock is enabled — but verify this is active on all business devices. Encryption ensures that a lost or stolen device’s data is inaccessible without the unlock credential. Without encryption, physical access to a device can bypass the screen lock entirely using forensic tools.

Remote Wipe Capability

Every business mobile device must have remote wipe capability configured before it is lost or stolen — not after. Options:

• Apple iCloud Find My (iOS): Enables remote lock and erase of Apple devices. Requires the device to be linked to an Apple ID with Find My enabled.
• Google Find My Device (Android): Enables remote lock, display of a message, and erase of Android devices. Requires a Google account and Find My Device enabled.
• Mobile Device Management (MDM) platform: For businesses managing multiple devices, an MDM solution provides centralized remote wipe alongside policy enforcement, app management, and compliance monitoring.

When a device is reported lost or stolen, initiate remote wipe immediately — do not wait to see if it turns up. Business data on a lost device is a liability until it is wiped.

Keep Operating Systems and Apps Updated

Mobile operating system updates frequently include critical security patches. Unpatched mobile devices are vulnerable to exploits that are publicly documented and actively used by attackers. Enable automatic OS updates on all business mobile devices and set a policy requiring updates within 30 days of release. Remove unused apps — every installed application is a potential attack surface.

Avoid Public Wi-Fi Without VPN

Public Wi-Fi networks at coffee shops, airports, and hotels are unencrypted and easily monitored. Any business activity — checking email, accessing cloud systems, reviewing financial data — conducted over public Wi-Fi is potentially visible to anyone on the same network. Require VPN use whenever employees access business systems from public Wi-Fi on mobile devices. Most business VPN solutions have mobile apps that make this practical.

Mobile Device Management (MDM) for Small Business

MDM solutions provide centralized control over all mobile devices in your organization — enforcing security policies, managing app installations, enabling remote wipe, and monitoring compliance. For businesses with more than five employees using mobile devices for work, MDM is worth evaluating.

Small business MDM options include:

• Microsoft Intune (included in Microsoft 365 Business Premium): Full MDM and MAM (Mobile Application Management) capability included in the Business Premium subscription many small businesses already pay for. Manages both company-owned and personal BYOD devices.
• Jamf Now: Apple-focused MDM for businesses with primarily iOS and Mac devices. Free for up to 3 devices, then approximately $4/device/month.
• Google Workspace MDM: Basic MDM capabilities included in Google Workspace Business plans — enforce screen lock, require encryption, and remote wipe enrolled Android and iOS devices.

Personal Devices Used for Work (BYOD)

When employees use personal devices to access business email or systems, the business has limited control over device security — but not zero. Minimum BYOD security requirements to enforce through policy:

• Screen lock with strong PIN or biometric required
• Device encryption enabled
• Current OS version — devices more than two major versions behind are not permitted
• No jailbroken or rooted devices
• Business apps (email, VPN, document storage) installed and configured by IT before access is granted
• Employee consent to remote wipe of business data if the device is lost or the employee leaves

Mobile Application Management (MAM) allows businesses to wipe only business data from a personal device — not the entire device — which addresses the employee privacy concern that makes full MDM on personal devices contentious.

Smishing and Mobile Phishing

Smishing — phishing via SMS text message — has increased dramatically as email phishing defenses have improved. Mobile phishing also arrives via WhatsApp, Instagram DMs, LinkedIn messages, and other social platforms. Train employees specifically on mobile phishing indicators:

• Unexpected text messages claiming to be from banks, delivery services, or the IRS requesting urgent action
• Links in text messages — even from known contacts whose numbers may have been spoofed
• Requests to install apps from links in messages rather than the official App Store or Google Play
• Social media messages requesting business credentials, wire transfers, or sensitive information

Mobile Security Checklist

• Screen lock with 6+ digit PIN or biometric on all business devices
• Auto-lock set to 5 minutes or less
• Full device encryption active
• Remote wipe configured and tested
• OS and apps current — auto-updates enabled
• VPN required on public Wi-Fi
• MDM enrolled for company-owned devices
• BYOD policy documented and signed by employees
• Smishing awareness included in security training

Bottom Line

Mobile devices are full business computers in employees’ pockets — they deserve the same security attention as laptops and desktops. Screen lock, encryption, remote wipe, and current software are the non-negotiable baseline. For businesses with multiple employees using mobile for work, Microsoft Intune through Microsoft 365 Business Premium provides enterprise MDM capability already included in a subscription many small businesses pay for. Enable it before a device is lost, not after.