Employees want to read company email on their personally owned phones. The security team must define requirements such as device enrollment, a screen lock, and the company's right to remotely wipe corporate data from those phones. Which policy should define these requirements?

A bring your own device policy governs personally owned devices that access organizational data. It sets eligibility, mandatory controls such as mobile device management enrollment, screen lock, encryption, and minimum operating system versions, and it records the employee's consent to actions such as a selective or full remote wipe of corporate data. Because the phone is the employee's property, that consent and the privacy boundaries between personal and corporate content must be written down before access is granted. An acceptable use policy defines permitted and prohibited use of organizational systems and equipment; it may reference BYOD, but it does not normally establish enrollment requirements or wipe rights on personal property. A data disposal policy covers how media and records are destroyed or sanitized at end of life, which is a different lifecycle stage. A clean desk policy requires that sensitive papers and devices are secured when a work area is unattended; it concerns physical exposure in the office, not mobile device controls. Exam caveat: some organizations choose corporate-owned models instead of BYOD, and a scenario with company-issued phones would point elsewhere. Operational check: confirm that the BYOD policy is acknowledged by each user during device enrollment and that the management platform enforces the screen lock and selective wipe settings it describes.