What Is MDM? Mobile Device Management for Regulated Small Firms

What is MDM?

MDM, or mobile device management, is software that lets IT manage a laptop, tablet, or phone remotely. You enroll the device once. From then on, IT can change its settings, check that it’s still configured correctly, install or remove work apps, and lock or erase it from anywhere it has a connection. Nobody has to touch it.

Apple’s deployment guide puts it plainly: a device management service lets IT “securely and remotely configure devices by sending configurations, profiles, and commands to the device.” Microsoft’s Intune overview says the same thing in its own words: once a device is enrolled, the service “manages the whole device, including settings, security, and apps. If a device is lost or stolen, you can wipe it.”

You’ll also see the term EMM (enterprise mobility management) or UEM (unified endpoint management). NIST’s SP 800-124 Rev. 2, its guide to managing mobile devices in organizations, treats those as the bigger umbrella. An EMM suite “may encompass” MDM, app management, and mobile threat defense. For a small firm, the label doesn’t matter much. What matters is what the tool controls.

What does MDM actually control?

MDM controls five things: how a device joins your company, the security settings on it, whether its storage is encrypted, which apps it runs, and what happens to it when it goes missing. Here’s each one in plain terms, using the capabilities NIST lists in section 4.2 of SP 800-124 Rev. 2.

• Enrollment. The device signs up with your management service. On company hardware this can happen automatically during first setup, through programs like Apple Automated Device Enrollment, Windows Autopilot, or Android Enterprise. On a personal phone, the user enrolls it themselves.
• Policies. A passcode to unlock the device, an auto-lock after a short idle time, a limit on wrong passcode attempts, and blocks on things like the camera, removable storage, or copy and paste out of work apps. MDM can also cut off access for devices running an old OS version or devices that have been jailbroken.
• Encryption. NIST’s list includes “strongly encrypt stored data” on the device and on removable media. On a Windows laptop that usually means BitLocker, with the recovery key stored somewhere other than the laptop.
• App control. Push the apps people need, remove the ones they shouldn’t have, and protect the data inside work apps like Outlook and Teams.
• Remote lock and wipe. If a device is lost, lock it. If it’s stolen, erase it. NIST says to wipe “if it is suspected that the device has been lost, stolen, or otherwise fallen into untrusted hands.”

MDM also gives you an inventory as a side effect. Every enrolled device shows up in one console with its owner, model, OS version, and encryption status. That list is what an auditor will ask for.

How is MDM different on company-owned and personal devices?

On a company-owned device, IT manages the whole thing and can factory reset it. On a personal phone (BYOD, “bring your own device”), IT should manage only the work apps and work data, and a wipe removes only those. Everything else on the phone stays the employee’s.

Microsoft calls the lighter mode mobile application management (MAM). Its Intune overview says MAM manages “only the work apps and the data inside them, not the rest of the device,” and that when someone leaves “you can selectively wipe organization data without touching personal content.” Apple’s version is User Enrollment, where IT can manage “only an organization’s accounts, settings, and information… never a user’s personal account.” Google’s Android work profile separates work apps from personal ones so “your personal apps, data, and usage remain private.”

NIST draws the same line. It describes a full-device wipe for company-owned devices and an “enterprise wipe” that deletes only work data for personal ones. The practical rule for a small office: if the device holds client data and the company paid for it, manage all of it. If it’s an employee’s phone that only reads email, use the work-only mode and get the employee’s agreement in writing before you enroll it.

Why do regulators and insurers care about MDM?

They care because a lost laptop full of client records can turn into a reportable incident. No rule we know of says “you must buy MDM.” The rules ask for device controls, encryption, and an inventory, and MDM is how you show those exist.

• HIPAA. The Security Rule’s device and media controls standard requires policies for hardware that holds ePHI coming into and out of your office, plus procedures for disposal and re-use. HHS breach guidance says PHI encrypted to the standard it describes is not “unsecured,” as long as the key “has not been breached.” That’s why a lost encrypted laptop is a very different day from a lost unencrypted one. Medical practices can see how we handle this on our medical practices page.
• FTC Safeguards Rule. 16 CFR 314.4(c) requires firms covered by the rule to “identify and manage the data, personnel, devices, systems, and facilities” they rely on and to encrypt customer information “at rest.”
• Cyber insurance. Carriers ask for encryption status and a device inventory. In one case we published, a client’s renewal required full-disk encryption on all 127 endpoints within 72 hours or the policy would lapse.

What happens when a managed laptop gets stolen?

When a managed laptop is stolen, IT confirms the theft, records who approved the action, and sends a lock or wipe command the next time the device is online. Encryption is supposed to protect the data in the meantime. Our stolen-laptop report shows how that plays out, and where it doesn’t go by the book.

A sales rep’s laptop was taken at an airport gate on a Friday afternoon. It was BitLocker-encrypted, but it was asleep, not powered off, so the encryption wasn’t gating anything yet. The thief already had it on their own network. Waiting for the device to check in with the cloud MDM service could have taken hours. Our RMM agent was online, so we got the sales director’s authorization, logged it in the ticket, and pushed a factory reset through the same Windows wipe mechanism that MDM tools use. It went from theft report to wipe in 16 minutes, and we found no evidence that any data left the laptop.

NIST warns about exactly this. In SP 800-124 Rev. 2 it calls remote wipe “a fundamentally unreliable security control” when used by itself, because an attacker can read the device first or just keep it offline. Wipe is the backup. Encryption, a short auto-lock, and a ready plan are what actually protect you.

Key takeaways

What this looks like when we do it

Under our managed IT and security service, every machine gets a security baseline before anything goes wrong. In practice that means an RMM agent on each laptop and desktop, BitLocker turned on with the recovery keys escrowed away from the device, and a hardware inventory that shows each device’s encryption status. We keep a wipe procedure tested and written down, so nobody is writing PowerShell at 5 PM on a Friday.

For phones, we start with a question about who owns them. Company phones get full management. Personal phones that only need email get the work-only mode, so you can remove client data when someone leaves without touching their photos. Then we write down what’s in place, because HIPAA and the Safeguards Rule both want to see records, not just good intentions. Our managed IT and security page covers the rest of the baseline.

Not sure which of your devices would survive being left at an airport gate? Book a call and we’ll go through it with you.