Common Failures, Listed
Twelve ways device programmes go wrong, each with the signal and the fix. Most have four or five.
Reference · Reference
In the design
One policy for all ownership models. Signal: a single document covering corporate and personal devices. Fix: one per population.
The practical question in “Common Failures, Listed” is how to make work visible without confusing visibility with certainty. For teams researching time tracking software, time tracking software can add time and project context to the operational record, provided its use is proportionate, disclosed and reviewed with the people affected.
Personal devices fully enrolled. Signal: full wipe is available on hardware the employee bought. Fix: work profile, and remove the capability.
For an independent baseline relevant to “Common Failures, Listed”, the CISA mobile-device security guidance is a useful companion: compare its principles with the proposed configuration, ownership model and real support process before approving a rollout.
No alternative to enrolment. Signal: nobody has ever declined. Fix: application management or a loaned device, before the first refusal.
In the communication
Vagueness about visibility. Signal: no published list of what is not collected. Fix: write it, check it against the configuration.
Deployed without explanation. Signal: resistance that administrators find irrational. Fix: not recoverable retrospectively.
Nothing offered in exchange. Signal: BYOD with no stipend and no position on out-of-hours contact. Fix: the position costs nothing.
In the configuration
Desktop passcode standards on phones. Signal: complexity requirements on a device unlocked a hundred times a day. Fix: match the platform's protections.
Failed-attempt wipe on personal devices. Signal: it is enabled. Fix: turn it off.
Full application inventory on personal devices. Signal: nobody checked what is collected. Fix: a configuration change.
In the operation
Wipe available to everybody technical. Signal: it is a role rather than named individuals. Fix: name them; selective as default.
Silent devices counted as compliant. Signal: enrolment and compliance both look better than reality. Fix: audit devices not checked in.
No hold check before departure wipes. Signal: nobody asks. Fix: one question in the leaver process.
The pattern
Six of the twelve are configuration and fixed in a day.
Four are design decisions needing a change of approach.
And two are not recoverable: deploying without explanation, and a wipe that destroyed somebody's personal data. Both are trust rather than technology.
The order to fix them
If you do one thing: make sure full wipe cannot reach a personal device.
If two: publish what is not visible.
If three: check what your configuration collects from personal devices.
Those three cost a day and address most of the twelve.
What to check
Which of the twelve do you have?
Are any of them the two that cannot be undone?
Which is cheapest to fix?
And has anything from your last review actually changed?