casemark/byod-policy
skills/legal/byod-policy/SKILL.md
Drafts a Bring Your Own Device (BYOD) policy for U.S. employers governing personal device access to company systems. Covers MDM enrollment, encryption, remote wipe authority, privacy expectations, data classification, and regulatory overlays (HIPAA, GLBA, SOX, GDPR). Use when creating or updating BYOD policies, mobile device security policies, or personal device programs.
$ install --global
skillsauthnpx skillsauth add casemark/skills byod-policyInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 25, 2026, 3:30 AM27.7s1 file scanned
SKILL.md
- name:
- byod-policy
- language:
- en
- description:
- Drafts a Bring Your Own Device (BYOD) policy for U.S. employers governing personal device access to company systems. Covers MDM enrollment, encryption, remote wipe authority, privacy expectations, data classification, and regulatory overlays (HIPAA, GLBA, SOX, GDPR). Use when creating or updating BYOD policies, mobile device security policies, or personal device programs.
BYOD Policy
Generates an employer-facing BYOD policy balancing operational flexibility with data security, regulatory compliance, and enforceable employee obligations.
Prerequisites
Gather before drafting:
- Organization profile — industry, size, applicable regulations (HIPAA, GLBA, SOX, GDPR, CCPA)
- Device scope — smartphones, tablets, laptops, wearables
- MDM platform — company-approved mobile device management software, if any
- Data classification — which tiers are permitted on personal devices
- IT support boundaries — helpdesk scope for personal vs. company apps
- Stipend terms — any reimbursement for device use
Output Structure
| # | Section | Key Contents | |---|---------|-------------| | 1 | Purpose & Scope | Why BYOD is permitted; covered employees, devices, systems | | 2 | Eligibility & Enrollment | Approval process; IT registration; MDM installation | | 3 | Security Requirements | Minimum device standards (see checklist below) | | 4 | Company Rights | Remote access, monitoring, wipe authority and triggers | | 5 | Privacy Expectations | What company may/may not access; commingled data | | 6 | Employee Responsibilities | Reporting obligations; financial responsibility | | 7 | Data Handling | Permitted classifications; backup, retention, deletion | | 8 | Regulatory Compliance | Industry-specific overlays | | 9 | Support & Liability | IT support scope; negligence liability | | 10 | Acknowledgment | Signature block; disciplinary consequences |
Key Section Details
Security Requirements (Section 3)
Include minimum standards:
- Screen lock: PIN/password ≥ [X] chars, biometric, or MFA
- Patching: OS/security updates within [X] days of release
- MDM agent installed and active
- Full-device or work-profile encryption enabled
- Auto-lock timeout ≤ [X] minutes
- Remote wipe confirmed before enrollment
- Prohibited: jailbroken/rooted devices; sideloaded apps
Remote Wipe (Section 4)
Enumerate trigger conditions: termination/resignation, lost/stolen device, confirmed/suspected breach, sustained non-compliance (after notice), employee opt-out.
Distinguish selective wipe (corporate data only) from full device wipe and specify which MDM capability applies to each.
Privacy Scope (Section 5)
| Company MAY access | Company will NOT access | |---|---| | Business email, calendar, contacts synced to company systems | Personal photos, texts, personal email | | Company app activity and data | Personal app data outside company systems | | Traffic routed through company VPN | Personal browsing not on company infrastructure | | Documents in company cloud storage | Personal files never synced to company systems |
Acknowledgment (Section 10)
Include: employee printed name, signature, date, department/manager, optional witness/HR signature. Statement must confirm employee has read, understands, and agrees to comply, with notice that violations may result in discipline up to termination, BYOD revocation, and/or legal action.
Drafting Checks
- Jurisdiction: U.S.-focused; flag state-specific laws (CA CPRA, IL BIPA, NY SHIELD) requiring additional notice
- Healthcare: HIPAA minimum necessary standard; assess BAA obligations if PHI on personal devices
- Finance: GLBA Safeguards Rule controls; SOX retention if device stores covered records
- Cross-border: GDPR Art. 32 measures; data transfer restrictions for EU employee data
- Enforceability: Require signed acknowledgment before granting access; retain in personnel files
- MDM transparency: Disclose what MDM monitors (app inventory, location, call logs) to reduce privacy claims and comply with state wiretapping statutes
- Stipend: Document device stipends in separate written agreement to avoid wage-and-hour issues
- Review cadence: Annual review; mandatory update on MDM platform change, new regulation, or data classification change
Related Skills
casemark/medical-records-gap-analysis
tools
VerifiedTrustedCommunity
Audits the complete in-scope medical-record universe in a litigation matter and produces an attorney-facing, Bates-cited analysis of treatment gaps, missing records or providers, baseline coverage, material billing or production mismatches, and complaint evolution. Use when asked to find missing medical records, analyze treatment gaps or first-care timing, identify absent providers, assess whether a production is complete, or prepare a records-request target list. Use medical-record-chronology instead when the primary request is a chronological clinical narrative.
40SKILL.mdUpdated Sep 3, 2026
casemark/private-placement-memo
development
VerifiedTrustedCommunity
Drafts a legally compliant Private Placement Memorandum for Regulation D offerings (Rule 506(b)/506(c)), covering full disclosure framework including risk factors, capitalization, securities terms, use of proceeds, and investor qualification requirements. Enforces SEC anti-fraud compliance under Section 10(b)/Rule 10b-5, blue sky law considerations, and accredited investor verification under Rule 501. Use this skill when drafting PPMs, offering memorandums, Reg D disclosure documents, or private offering circulars for issuers raising capital from sophisticated investors. Also trigger when the user mentions private placement disclosure, offering memorandum, Reg D fundraising, or accredited investor verification. Even if the user just says "PPM" or "draft our offering memo," use this skill.
40SKILL.mdUpdated Apr 17, 2026
casemark/privacy-law-updates
data-ai
VerifiedTrustedCommunity
Generates structured privacy and data protection law briefings across US, EU, UK, and other jurisdictions. Organizes by jurisdiction with compliance deadlines, enforcement actions, and legislative changes. Use when preparing privacy law briefings, compliance updates, regulatory change summaries, or data protection landscape reviews.
40SKILL.mdUpdated Apr 17, 2026
casemark/prior-art-summary
testing
VerifiedTrustedCommunity
Generates structured summaries of prior art references for patent prosecution, validity analysis, and freedom-to-operate assessments. Maps disclosures to claim elements with precise citations. Use when summarizing prior art, analyzing patent landscapes, mapping references to claims, or preparing office action responses.
40SKILL.mdUpdated Apr 17, 2026