Are employee devices leaving your business data exposed?

Did you know that 39% of UK businesses experienced a cyberattack in the past year? With cyber threats on the rise, frameworks like Cyber Essentials have become vital for demonstrating an organisation’s commitment to protecting sensitive data.

But for businesses running on the cloud, Cyber Essentials compliance can seem like navigating a maze—especially when data isn’t sitting on familiar local servers. A common misconception is that Cyber Essentials only applies to organisations with on-premises systems. In reality, cloud-based companies face distinct security challenges and are just as vulnerable to attacks.

We caught up with Dash Bunyan, A2Z Cloud’s Head of Innovation, to explore how Cyber Essentials strengthens security for cloud-based businesses. Dash shared insights on why asset tracking plays a pivotal role in protecting sensitive data and how A2Z Cloud’s approach ensures compliance, even in complex environments like those using Bring Your Own Device (BYOD) policies.

Why asset tracking matters

At its core, Cyber Essentials is about safeguarding sensitive information by demonstrating thorough and thoughtful security practices. Whether an organisation is using a cloud-based infrastructure like Zoho or a more traditional setup, compliance hinges on having detailed, replicable procedures.

Asset tracking, in particular, ensures businesses have full visibility over every device connected to their network—whether it’s a laptop, smartphone, or tablet. To earn Cyber Essentials certification, each one must be accounted for and secured, preventing unknown or vulnerable devices from accessing sensitive data. Think of it as maintaining a digital inventory of your most valuable assets— failing to do so is like leaving the front door of your data wide open.

As Dash Bunyan, Head of Innovation at A2Z Cloud, says, “It’s not just about knowing what devices are there; it’s about making sure none of them are an insecure, outdated liability.”

But what if your employees are using both personal and company devices? How do you maintain security without overstepping boundaries?

Addressing the challenges of BYOD

The Bring Your Own Device (BYOD) policy introduces a unique complexity.While it gives employees the flexibility to use their personal phones and laptops, it also increases the risk of compromised security. BYOD is widely adopted in modern workplaces due to its flexibility and cost-saving benefits, but it can be a double-edged sword if not properly managed. However, Dash explains that the solution isn’t about heavy-handed control:

“We’re not managing people’s phones directly—no one wants to be told what they can and can’t install on their personal device. But we do need to know some basics: what device they’re using, what operating system, and whether it’s up-to-date.”

This light-touch approach ensures you meet the Cyber Essentials requirements without infringing on personal freedom. If an employee’s phone is out-of-date or vulnerable, we can advise them to update or limit their access to sensitive company data.

How to monitor what devices are accessing company data

Managing both personal and company devices can be a security challenge, but Zoho Creator, a low-code platform for building custom business applications, can help. Using Zoho Creator, an asset tracker can be custom-built to log and track every device that interacts with company systems, capturing key details like: 

• Device Type

• Operating System

• Ownership (company or personal)

• Security Status

 With this inventory, businesses can monitor all devices accessing their data and respond swiftly to potential threats. The centralised asset register gives a clear view of every device, while BYOD management ensures that necessary information is tracked without the need to directly control personal devices. This balance supports security efforts and allows businesses to generate compliance reports that demonstrate full control—vital for certifications like Cyber Essentials.

Tracking operating system versions allows businesses to quickly spot outdated or vulnerable devices, while the integration with Zoho Assist ensures that updates can be deployed remotely, keeping devices secure without disrupting users. Additionally, the flexibility of Zoho Creator enables businesses to customise the system to their unique needs, all without the complexity that typically comes with traditional enterprise software.

Learning from the recent TFL data breach

Consider the recent Transport for London (TFL) cyberattack, which compromised sensitive personal details, including bank account information. Thousands of customers were affected, leaving them unable to access services like refunds or concession card applications. While the exact cause of the breach remains unclear, it serves as a sharp reminder of how vulnerable organisations can be without robust cybersecurity measures. Incidents like these highlight the critical need for comprehensive protocols—ensuring all devices, data, and systems are protected from sophisticated attacks.