Mobile Device Security for Small Business: Protecting iPhones and Androids at Work
Last updated:
Phones now hold work email, calendars, files and authentication prompts, yet they are often the least managed devices in a company. A few simple settings and a clear policy close most of the gap, whether the phone is company-owned or personal.
The basics for every phone
- Keep iOS and Android up to date, and remove phones that can no longer receive security updates.
- Require a passcode or biometric lock and automatic screen lock.
- Enable device encryption (on by default on modern phones when a passcode is set).
- Install apps only from the official app stores.
Protect work accounts
Use MFA for Microsoft 365 or Google Workspace, and consider a managed work profile or app protection policy so company data stays separate from personal data. This is especially useful with a bring-your-own-device policy.
Be careful with text and QR code scams
Scam messages and QR codes that lead to fake login pages are common on phones because the screen hides the full link. Staff should treat unexpected texts the same way they treat unexpected email.
Have a lost-phone plan
Know how to lock or wipe a device remotely, sign out active sessions, and reset the account password. Practice the steps once so they are familiar.
Public Wi-Fi
Avoid handling sensitive work on open networks, and prefer your phone’s own connection or a trusted VPN when traveling.
Related reading
- managed IT services in Portland
- Cybersecurity for small businesses (2026)
- Microsoft 365 Copilot security for small business
Talk to a local team
PDX Information Technology Services provides managed IT, cybersecurity and compliance support for small businesses in Portland, Lake Oswego, Beaverton, Hillsboro and Vancouver, WA. Plans start at $100 per user per month (Gold) and $180 per user per month (Platinum). Call 971-331-4871 or book a free assessment.
Request an IT assessment
Tell us a little about your business and a PDX IT team member will follow up to schedule an assessment. Prefer to talk? Call 971-331-4871.
About the author: Steve Shaff
Steve Shaff is the owner of PDX Information Technology Services, a managed IT provider he founded in 2020. From the Tualatin office he helps businesses across Portland Metro & Southwest Washington with IT support, cybersecurity and compliance. More about Steve ยท Contact PDX IT
Infostealer malware copies saved passwords and live session cookies from a browser and sells them on the dark web, which lets attackers walk past MFA. Here’s how it works and a practical 10-step plan for Portland-area small businesses.
Modern ransomware gangs don’t just lock your files. They copy your data first, then threaten to publish or sell it on the dark web. Here is how double extortion works and what Portland-area small businesses can do before, during and after an attack.
Portland small business mobile security checklist: lock phones, avoid risky public Wi-Fi, secure office wireless, spot text scams and handle lost phones.