Enterprise mobility security is the set of controls that keep business data safe on phones, tablets and rugged handhelds. Most of those controls run through an enterprise mobility management (EMM) platform, and they protect four things, which are the device, its apps, the data on it and who can use it.
This guide covers the risks that matter most for enterprise fleets, the EMM controls that address each one, how to write a mobile device security policy, and what changes for personal devices, shared frontline devices and Canadian organizations. If you’re new to EMM itself, start with what enterprise mobility management is.
Key takeaways
- Secure four layers. Device, apps, data and identity each need their own controls.
- Match control to ownership. Corporate-owned and dedicated devices can be fully managed. Personal devices should be managed at the app or work-profile level only.
- Updates are a security control. Unpatched devices are one of the most common gaps, especially in rugged fleets.
- Security runs the whole lifecycle. Staging, repair and retirement are where data is most often exposed.
- Canadian rules apply. PIPEDA accountability and breach reporting, Law 25 and sector rules shape your policy.
What enterprise mobility security covers
Mobile security works in layers. A gap in any one of them can expose data even when the others are solid.
| Layer | Main risks | EMM controls |
|---|---|---|
| Device | Loss, theft, outdated OS, tampering | Mobile device management (MDM), passcodes, encryption, OS update policies, remote lock and wipe |
| Apps | Malicious or unapproved apps, outdated app versions | Mobile application management (MAM), app allow and block lists, managed app stores |
| Data | Data copied to personal apps, files shared outside the organization | Work profiles, app protection policies, mobile content management |
| Identity | Stolen credentials, shared logins, non-compliant devices reaching business systems | Multi-factor authentication, single sign-on, conditional access |
For the difference between device-level and app-level control in more depth, see our comparison of MAM vs MDM.
The mobile security risks that matter most for enterprise fleets
Six risks account for most mobile security problems in enterprise fleets. Each has a matching control.
Lost and stolen devices
A lost device is only a minor incident if it’s encrypted, passcode-protected and enrolled. Remote lock and wipe let IT remove business data quickly, and activation locks stop a stolen device from being reset and reused. Our activation lock FAQ covers how to manage locks on corporate devices.
Outdated and unpatched operating systems
Devices that miss security updates stay exposed to known vulnerabilities. EMM can enforce minimum OS versions and update windows, and conditional access can block devices that fall behind.
Here’s what actually happens in rugged fleets. Updates get deferred because nobody has tested them against the scanning app, and months later part of the fleet is several versions behind.
Risky and unapproved apps
Apps can carry malware or leak data through excessive permissions. EMM controls which apps can be installed, pushes approved apps from a managed store and removes apps that are no longer allowed.
Data leaking between work and personal apps
Copying a customer record into a personal messaging app takes seconds. Work profiles and app protection policies keep business data inside approved apps and block copy, paste and sharing to personal ones.
Weak authentication and shared devices
Frontline devices are often shared across shifts, and shared logins make it impossible to know who did what. Shared-device sign-in, short session timeouts and multi-factor authentication for sensitive apps close that gap.
Data left on repaired or retired devices
Devices sent for repair or retired at the end of their life often still hold business data. Wiping before shipment, chain-of-custody records and certified erasure at retirement keep that data from leaving your control.
What a mobile device security policy should include
A security policy turns these controls into rules people can follow. The Canadian Centre for Cyber Security’s guidance on mobile device deployments and NIST’s SP 800-124 Rev. 2 are good starting points. Most enterprise policies cover these elements.
- Allowed ownership models. Which roles get corporate-owned, personally enabled, dedicated or personal devices.
- Enrolment requirement. No device reaches business systems without enrolling in EMM.
- Authentication. Passcode or biometric rules, plus multi-factor authentication for sensitive apps.
- Encryption. Required on every device that holds business data.
- OS and app updates. Minimum versions and the window for installing updates.
- App rules. Approved apps, blocked apps and how new apps are requested.
- Data handling. Where business data can be stored and shared.
- Lost or stolen device process. Who to call, how fast, and what IT does next.
- Monitoring disclosure. What the organization can and can’t see on each device type.
- Repair and retirement. How devices are wiped before repair and certified at end of life.
Write the policy for the people who’ll follow it. A driver or nurse needs to know what to do when a device goes missing, not the details of the conditional access rules.
How to secure corporate-owned and dedicated devices
Corporate-owned devices can be managed fully, and that’s where EMM security is strongest. On Android they run as fully managed devices, and on Apple devices they’re supervised, which gives the organization additional control over configuration and restrictions.
Frontline fleets often use dedicated mode, which Android Enterprise describes as locking a company-owned device to a limited set of apps for one purpose. For a warehouse scanner or a delivery handheld, that removes most of the risk from unapproved apps and browsing in one step.
Rugged devices need one more control. Their update cycles often lag consumer devices, so plan update testing by model and keep a record of which devices sit on which OS version. Our guide to rugged mobile computing covers what’s different about these fleets.
How to secure personal devices without overreaching
Personal devices need protection for business data without control over personal data. Work profiles and app-level protection do that by separating the two.
The Privacy Commissioner of Canada’s guidance on bring your own device programs recommends a privacy impact assessment before starting, a clear policy on monitoring, restricting the flow of information between the work and personal containers, and the ability to wipe the work container when someone leaves. It also notes that containers reduce risk but don’t eliminate it.
Just know that the more you monitor a personal device, the harder the privacy conversation becomes. For most roles, app protection plus conditional access is enough.
Identity and conditional access for mobile devices
Identity controls decide whether a device gets to business systems at all. Conditional access checks each request against rules, such as whether the device is enrolled, encrypted and on a supported OS, before granting access.
Combine that with single sign-on to reduce password reuse and multi-factor authentication for sensitive apps. A device that drifts out of compliance then loses access automatically, rather than waiting for someone to notice.
Mobile security across the device lifecycle
Mobile security isn’t only about devices in use. Data is often most exposed when a device is being set up, repaired or retired.
Staging
Devices should reach users already enrolled, encrypted and on a current OS. Consistent staging also means every device starts from the same security baseline, which our staging and deployment guide covers.
In use
Keep devices patched, watch compliance reports and act on devices that fall out of policy. Review app permissions when apps update.
Repair
Wipe or secure business data before a device ships for repair, and track it while it’s away. Ask who holds the device at each step.
Retirement
Remove the device from management, release activation locks and erase data to a recognized standard such as NIST SP 800-88 Rev. 2, with a certificate for each serial number. The secure device decommissioning guide lists what each record should contain.
Canadian requirements that shape mobile security
Canadian organizations have specific obligations when mobile devices hold personal information. These shape both your controls and your incident process.
PIPEDA accountability and breach reporting. You stay responsible for personal information on your devices, including when a provider handles them. Breaches that pose a real risk of significant harm must be reported to the Privacy Commissioner and to affected individuals, and all breaches must be recorded. A lost, unencrypted device with customer data on it can trigger that process.
See our post on PIPEDA compliance for mobile device management.
Quebec Law 25. Law 25 adds privacy impact assessments and rules for information leaving Quebec, which affects where devices are repaired or wiped. See Law 25 and mobile device management.
Government and health care. Federal organizations work within the ITSG-33 security control framework, covered in our guide to ITSG-33 mobile device management. Ontario health organizations also need to meet PHIPA.
These are planning considerations, not legal advice. Confirm specific obligations with your legal and privacy teams.
Common mobile security gaps in enterprise fleets
Most mobile security gaps come from operations, not missing features. These are the ones we see most often.
Devices outside the console. Devices in use that never enrolled, or that dropped out of management, sit outside every control.
Deferred updates. Updates postponed for app compatibility and never revisited leave parts of the fleet exposed.
One profile for every device. A single policy for smartphones and dedicated scanners is too loose for one and too restrictive for the other.
Shared logins on shared devices. Without individual sign-in, incident investigation stalls at “someone on the night shift”.
Unrecorded retirement. Devices retired without a wipe certificate are a breach you can’t rule out.
Who should run your mobile security controls
EMM security controls need daily attention. Someone has to watch compliance, test updates, respond to lost devices and keep profiles current.
If your team has the capacity and the fleet is uniform, running those controls in-house works. If EMM knowledge sits with one person, or your fleet mixes rugged and consumer devices across many sites, MDM as a Service puts certified administrators on your platform. The MDM as a Service guide explains how it works, and managed mobility services extend the same model to the full device lifecycle.
Where PiiComm fits in enterprise mobility security
PiiComm is Canada’s largest pure-play managed mobility services provider. Our certified technicians administer your existing EMM or UEM platform through MDM as a Service, including policies, updates and compliance, and the physical work that affects security (staging, repair and certified decommissioning) is done in-house, in Canada.
We’re a strong fit for organizations running frontline fleets across many sites. We’re not the right choice if you need a security software vendor rather than a service, or a provider for fleets spread across many countries.
Questions we hear about enterprise mobility security
What is enterprise mobility security?
Enterprise mobility security is the set of policies and controls that protect business data on phones, tablets and rugged handhelds. It covers four layers, the device, its apps, the data on it and the identity of the person using it. Most of these controls run through an enterprise mobility management (EMM) or unified endpoint management (UEM) platform.
What is the difference between MDM and MAM for security?
MDM secures the whole device, with passcodes, encryption, OS update rules and remote wipe, and suits corporate-owned devices. MAM secures business apps and their data without managing the rest of the device, which suits personal devices. Many organizations use MDM for corporate devices and MAM for personal ones within the same EMM platform.
What should a mobile device security policy include?
A mobile device security policy should cover allowed ownership models, an enrolment requirement, authentication rules, encryption, minimum OS versions and update windows, approved and blocked apps, data handling, the lost or stolen device process, what monitoring takes place on each device type, and how devices are wiped before repair and at retirement.
How do you secure BYOD devices?
Secure personal devices with a work profile or app protection policies that keep business data inside approved apps, plus conditional access and multi-factor authentication. Avoid managing the whole device. In Canada, the Privacy Commissioner recommends a privacy impact assessment, a clear monitoring policy and the ability to wipe only the work data when someone leaves.
How do you secure shared frontline devices?
Run shared frontline devices in dedicated or kiosk mode so they’re locked to the apps workers need, use individual sign-in rather than shared logins, set short session timeouts, and enforce encryption and OS updates centrally. Test updates against your business apps by device model before fleet-wide release so security updates don’t stop work.
What happens to data when a device is repaired or retired?
Before repair, business data should be wiped or secured and the device tracked while it’s away. At retirement, the device should be removed from management, activation locks released and data erased to a recognized standard such as NIST SP 800-88 Rev. 2, with a certificate recorded for each serial number.
What are the biggest mobile security risks for enterprises?
The biggest risks are lost and stolen devices, outdated operating systems, risky or unapproved apps, business data leaking into personal apps, weak authentication on shared devices, and data left on devices sent for repair or retirement. Each has a matching EMM control, and most gaps come from how controls are run rather than missing features.
Does a lost device have to be reported as a privacy breach in Canada?
It can. Under PIPEDA, a breach involving personal information that poses a real risk of significant harm must be reported to the Privacy Commissioner and to affected individuals, and every breach must be recorded. Whether a lost device qualifies depends on the data on it and whether it was encrypted. Confirm with your privacy officer or legal team.
Keeping enterprise mobility secure
Mobile security holds when every layer is covered and every stage of the lifecycle is controlled. Write the policy, match controls to ownership and keep the fleet patched.
If your EMM controls need more attention than your team can give them, talk to one of our mobility specialists about MDM as a Service.
References
- Canadian Centre for Cyber Security, Security considerations for mobile device deployments (ITSAP.70.002). Deployment models and security features.
- NIST, SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise (2023). Mobile security across the lifecycle.
- NIST, SP 800-88 Rev. 2, Guidelines for Media Sanitization (2025). Data erasure standard.
- Office of the Privacy Commissioner of Canada, Is a BYOD program the right choice for your organization? (modified 2025). BYOD privacy recommendations.
- Office of the Privacy Commissioner of Canada, Mandatory reporting of breaches of security safeguards (2025). Breach reporting and record-keeping.
- Apple Platform Deployment, About Apple device supervision. Supervision of organization-owned devices.
- Google for Developers, Android Enterprise terminology. Dedicated device mode and work profiles.