If the CIO chooses not to support the BYOD device, he risks alienating the CEO. If the CIO chooses to support the device, he risks opening up the floodgates to chaos: VPs, GMs, directors and others will want to use the same device for personal use and work, too.
One response is to isolate the CEO and his device into a "test group" in order to buy time to create a BYOD strategy and policy. Winthrop recommends sitting down with the CEO to go over the impact and corporate risks associated with allowing a new device on the network.
The Dropbox problem and private app stores
BYOD also invites the use of cloud-based storage through apps like Dropbox, but the CIO has to make sure corporate data doesnt find its way onto these mostly free consumer services. Some cloud storage service providers offer an enterprise service. The key is to make it easy and seamless for end users who are familiar with simple-to-use Dropbox.
"You could try to push people to Sharepoint, but that's probably not going to work," says Hyatt Hotels' Malcom.
Building a corporate app store for BYOD can also be quite a feat. Thats when you'll need to tap social networks whereby employees can discuss which apps are good on the job, and which ones should be avoided, says Lalli of Bank of New York Mellon. Blacklisting apps without this discovery period can lead to trouble; employees won't stop using apps on BYOD devices because of an IT mandate.
An app store can also play in your favor, too. By creating app stores for various devices, employees in a BYOD program can choose the device that has the apps and Web services available to it. "Give users a sliding scale," says Ruger of Motorola Mobility.
Lost devices: To wipe or not to wipe
Perhaps the biggest concern with BYOD is lost devices -- and lost corporate data. Most companies with a BYOD policy will reserve the right to wipe the lost device. There's just one problem: An employee has to report the device as lost. This could take weeks before the employee relents, reports the device lost, and loses all the data on it.
One of the recommendations by the panel is to take a tiered approach, as a way to give employees the incentive to report a lost BYOD device. That is, lock it down first before wiping it.
Clearly, BYOD opens up a host of concerns for CIOs. But CIOs should work through these issues sooner rather than later.
"Don't lie to yourself, people are going to use these devices," Malcom says.