Who should own the bring your own device policy?

The clauses imply the head of IT operations. The register names the role so the line on your list can carry a name.

How often should a bring your own device policy be reviewed?

Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).

Is there a template for a bring your own device policy?

Yes: https://compliance.theartofservice.com/policy-templates/byod-policy

Every policy type · Operations and technology

Bring your own device policy

Q: What must a bring your own device policy contain under ISO 27001?

8.1: Protect information stored on, processed by or reachable through user endpoints. 6.7: Apply security measures when people access, process or store information outside the organization's premises. The ISO 27002 guidance beside 8.1: Requires information stored on, processed by or accessible through user endpoint devices to be protected.

The conditions under which a personally owned device may reach organisational data, and what the organisation may do to it.

How the register reads it

Also called	BYOD, personal devices
Family	Operations and technology
Document type	Policy. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Folds into	The regimes accept it folded into the mobile device policy; when neither is listed, the gap is counted once, under the parent.
Expected owner	The head of IT operations.
Review cadence	Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list when	never on its own: the register recognises it and names the clauses, but no ticked regime lists it as a separate document.
Template	Byod policy.

Which standards require it, and what each expects it to contain

2 requiring clauses, 1 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 8.1 User end point devices

Protect information stored on, processed by or reachable through user endpoints.

What the ISO 27002 guidance expects the document to say: Requires information stored on, processed by or accessible through user endpoint devices to be protected.

Evidence an auditor accepts: The endpoint device policy covering corporate and personally owned devices, registration, permitted use and required protections; configuration baselines for each device type and evidence of compliance across the estate, with the percentage of devices compliant; evidence of the protective measures in force, such as full disk encryption, endpoint detection, screen lock, patch currency and restriction of administrative rights
Common gap: Incomplete device inventory
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

ISO 27001 6.7 Remote working

Apply security measures when people access, process or store information outside the organization's premises.

What the ISO 27002 guidance expects the document to say: Requires security measures to be implemented when personnel work remotely, protecting information that is accessed, processed or stored outside the organisation's premises.

Evidence an auditor accepts: The remote working rules, covering approval, permitted locations, equipment, network use and handling of physical material; technical measures evidence, such as device encryption, endpoint protection, secure remote access configuration and enforced patching for remote devices; evidence of protection where personally owned devices are used, including separation of organisational information
Common gap: Missing MFA for remote access
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Backup policy · Certificate management policy