SCOPE: everything in progressdocs/compliance/byod-policy.md · build 40bb41bdb460

BYOD and laptop policy (draft)

Sign-off: approved by [Kyle] on [date], second reader [Dan] on [date]; recorded in approvals.md. Review yearly.

Draft for ORG-16, 27 Oct 2026. Owner: Kyle. Everyone at Lucent Axis who works on SCOPE does so on a personal laptop, so this policy is how those laptops become part of the control set (ORG-15).

Scope

Every laptop or desktop used to read SCOPE's code, sign in to GitHub, Vercel, Supabase, Google Workspace or the vault, or open SCOPE with customer data. Phones only for MFA prompts and email. The client's shared driver tablets are the client's devices and are not covered here.

Rules

  1. Disk encryption on. FileVault (Mac) or BitLocker (Windows).
  2. Screen lock after 5 minutes idle, with a password or biometrics.
  3. Operating system updates installed within 14 days of release; critical security updates within 7.
  4. A device check every quarter, at the access review: Google Workspace endpoint verification where our edition reports it, else a dated screenshot of each laptop showing disk encryption, screen lock and OS version. We do not install anything that reads personal files or browsing. If a compliance platform is chosen, its device agent can replace the screenshot.
  5. Malware protection: the operating system's built-in protection on (XProtect on a Mac, Microsoft Defender on Windows).
  6. Separate user account for work, or a separate browser profile at least, so company sign-ins do not mix with personal ones.
  7. No customer data saved to the laptop, except where the work needs it, and then deleted when the work is done. No customer data in personal cloud storage, personal email or AI chat tools.
  8. Secrets: only in the company vault and in .env.local (git-ignored). Never in chat, email, notes or a committed file.
  9. Lost or stolen: report it to Kyle at once, and within 1 hour of noticing. That is a security incident (see the incident response plan): sessions are revoked and tokens rotated.
  10. On leaving: company accounts are removed (see onboarding-offboarding.md), the repository and any customer data are deleted from the laptop, and the person confirms it in writing.

Exceptions

Asked for in writing, approved by Kyle, recorded with an end date in docs/compliance/evidence/<year>/ and the control calendar log (or in the compliance platform, if one is chosen).

Evidence the auditor will ask for

Each quarter's device check for every in-scope laptop (the endpoint verification report or the dated screenshots, filed under docs/compliance/evidence/<year>/), and each person's signed acceptance of this policy.

Back to top