Every October, Cybersecurity Awareness Month puts a spotlight on passwords, phishing, and software updates. Those matter. But for organizations running hundreds or thousands of phones and tablets, the bigger risk usually isn’t one weak password. It’s the device that was never fully enrolled, the tablet that left with a former employee, or the scanner that has been three operating system versions behind since spring.
Mobile devices don’t sit behind a single office firewall. They ride in trucks, sit on nursing carts, live in classrooms, and get left on the seat of a service van. That makes mobile security less about a single tool and more about discipline across the whole device lifecycle, from the day a device is ordered to the day it is wiped and retired.
This checklist follows that lifecycle. Use it as a self-audit this month, or hand it to whoever owns your device program and ask how many boxes they can honestly check.
Stage 1: Before the device ships
1. Every device is enrolled in mobile device management before it reaches a user. Mobile device management (MDM) is the software IT uses to configure, monitor, secure, and wipe devices remotely. If a device reaches an employee before it’s enrolled, you are relying on that person to finish setup correctly. Some will. Some won’t.
Zero-touch enrollment programs solve this. Apple Business Manager (formerly the Device Enrollment Program, or DEP), Samsung Knox Mobile Enrollment, and Android Zero-Touch Enrollment tie a device’s serial number to your organization so it enrolls in MDM automatically the first time it powers on. A user can’t skip it, and a factory reset doesn’t remove it.
2. Devices are configured to a standard profile. Decide in advance which apps are installed, which are blocked, what the passcode rules are, whether the camera is allowed, and whether the device runs in a locked single-app mode (often called kiosk mode). Then apply that profile the same way every time. Inconsistent setup is one of the quietest security gaps in any fleet.
3. Asset tags and serial numbers are recorded before shipment. You can’t protect what you can’t find. A clean record that ties each serial number to a user, location, or vehicle is what makes remote lock, wipe, and recovery possible later.
Stage 2: While the device is in use
4. Operating system and security updates are enforced, not suggested. Most MDM platforms can require updates within a set window or defer them for testing. Pick a policy and enforce it. A device that asks the user to update “later” will often stay unpatched for months.
5. Passcodes and biometrics are required. It sounds basic. It is still one of the most common findings in a device audit, especially on shared tablets where teams turn off the lock screen because it slows down the shift.
For shared devices, look at shared-device modes or app-level sign-in instead of disabling the lock entirely.
6. Work data is separated from personal data. If employees use their own phones (a bring-your-own-device, or BYOD, program), work profiles on Android and User Enrollment on iOS let IT manage company apps and data without controlling the whole personal device. That balance keeps employees comfortable and keeps company data contained.
7. App installs are controlled. Push approved apps through MDM and restrict sideloading. On corporate-owned devices especially, there is rarely a good reason for users to install apps outside the approved list.
8. Network access is protected. Devices that connect to public Wi-Fi in hotels, airports, and coffee shops should route sensitive traffic through a virtual private network (VPN) or rely on cellular data. For field teams, a company-managed hotspot or fixed wireless router is often simpler and safer than public networks.
9. Compliance is monitored, not assumed. Set your MDM to flag devices that fall out of policy: jailbroken or rooted devices, devices that haven’t checked in for a set number of days, and devices running outdated software. Then make sure someone actually reviews that report.
Stage 3: When something goes wrong
10. There is a written lost-or-stolen device process. Who does an employee call? How fast is the device locked? At what point is it wiped? If those answers live only in one IT person’s head, the response will be slower than it should be.
11. Replacements are ready. Security and productivity are linked. If replacing a lost device takes two weeks, people find workarounds, like logging into work apps on personal devices that you don’t manage. A small pool of pre-configured spare devices shortens that gap and keeps users inside your security policy.
12. Departing employees return their devices. Offboarding should trigger device recovery automatically. Prepaid return kits and a clear deadline recover far more devices than a reminder email.
Stage 4: When the device is retired
13. Data is wiped to a verifiable standard. Retiring a device is a security event. IT asset disposition (ITAD) is the process of securely wiping, recycling, reselling, or disposing of retired equipment. Look for documented data sanitization with a certificate for each device so you have a record if anyone ever asks.
14. Retired devices are removed from MDM and accounts. A device that’s been resold but still appears in your MDM console, or is still tied to a user’s account, creates confusion and potential exposure.
15. Retirement feeds the next refresh. Devices with resale value can offset the cost of replacements through buyback programs. That turns a security task into a budget tool.
A quick self-scoring guide
| Score (out of 15) | What it usually means |
|---|---|
| 13 to 15 | A mature program. Focus on keeping processes documented as the fleet grows. |
| 9 to 12 | Solid foundation with gaps, often in lost-device response or retirement. |
| 5 to 8 | Security depends heavily on individual effort. Start with zero-touch enrollment and update enforcement. |
| 0 to 4 | The fleet likely has unmanaged devices today. An inventory and enrollment audit is the first step. |
Where most teams get stuck
In our experience working with growing organizations, the checklist itself is rarely the problem. Most IT leaders know what good looks like. The problem is capacity. Enrolling, configuring, tagging, shipping, replacing, and retiring devices by hand takes a lot of time, and lean IT teams are usually juggling it alongside everything else.
That’s where security quietly slips. A rushed deployment skips the asset tag. A replacement goes out unconfigured because the user needed it yesterday. A drawer of old phones waits months for someone to wipe them.
How ConnectUs helps
ConnectUs supports the full device lifecycle so security steps happen the same way every time, without adding to your internal team’s workload:
- Procurement and zero-touch enrollment: Devices are registered for enrollment programs such as Apple Business Manager and Samsung Knox, so they arrive ready to enroll in your MDM.
- Staging, configuration, and kitting: We apply your profiles, asset tags, and accessories before devices ship, so every user gets the same secure setup.
- MDM support: We work with the MDM platform you already use.
- Rapid replacement and recovery: Spare pools and return logistics keep users productive and inside policy.
- ITAD and buyback: Retired devices are wiped, documented, and, when they have value, turned into savings toward your next refresh.
For example, when an urgent care franchise rolled out more than 1,500 Apple iPads for patient check-in, ConnectUs used DEP enrollment so every device arrived managed from the first power-on. The rollout helped reduce patient wait times by an average of 17 minutes.
If your score came in lower than you’d like, this month is a good time to start. Talk with ConnectUs about a device lifecycle assessment and we’ll help you see where your program stands.