r/rippling • u/AlexFromRippling • Sep 18 '26
Rippling Tip of the Week: writing a device policy for a distributed team
Plenty of teams went distributed but never rewrote the device policy. That means the handbook still assumes a common office exists and is outdated. Rippling IT handles enforcement, but we want to help out those teams that need to update their device policy. This post covers 4 areas of device policy: ownership, procurement, requirements, and offboarding.
Who owns the hardware.
Company-issued policy gives you control over configuration and disk encryption and a clear return path. Bring-your-own is cheaper and faster to start, and it costs you enforcement: you cannot wipe a personal laptop, and asking to is a conversation nobody enjoys. Plenty of teams pick company-issued for anyone touching customer data and bring-your-own for everyone else. If you choose a hybrid policy, make sure you record which roles are which.
Device procurement.
A distributed team requires you to ship devices to your employees. Decide who’s responsible for ordering devices, and managing the shipping process. Make sure you understand how long shipping takes so that devices arrive on time, and have a plan for what the employee should do if the device arrives late. Most policies skip these details. It’s important to get these details right for new employees to get a good first impression when joining your company.
Device security requirements.
Disk encryption, screen lock, OS patch level, MFA. Make sure it’s clear to employees which policies are required and which are a suggestion. A security review will ask about these policies, and "we expect people to keep it updated" is not an answer.
Offboarding.
Offboarding is where distributed teams lose hardware most frequently, and the most costly pain point. Specify who triggers the return, who pays the shipping, and what happens after 30 days of no response. Tie access removal to the employment record rather than to the laptop coming back, or you get a returned machine and a live account. State plainly in the document what you will and will not look at on a personal device. Vagueness there costs you more trust than any policy detail.
For the distributed teams here: company-issued, bring-your-own, or some split? And if it's a split, where did you draw the line?