Open a secure mobility review with device facts

When a law firm asks for secure mobility, start with work rather than a product claim. Attorneys, assistants, and support staff often use different devices in different places. Internal guidance might also be under review. A useful first conversation identifies device facts, access paths, and people responsible for decisions. Those details give internal specialists a grounded agenda instead of an abstract concern.

Ask a practice leader or technology contact for one recent moment when someone needed client material away from a desk. Ask where the person was, which device they used, what material they needed, and how access began. Follow events in order. “People work everywhere” becomes useful only after a person describes a real task. Do not begin with a device count. A count without context says little about the work or choices under review.

In a fictional practice situation, Elise serves as chief information officer at a law firm. Elise says, “Partners travel often. Does your mobility program guarantee client files never leave a device?” Sam, an account executive, replies, “Your security and legal teams decide which controls fit firm policy. To prepare their review, please describe a recent matter someone needed while traveling.” Elise describes a partner reading a document on a personally owned tablet in an airport lounge after an assistant sent material from an office.

Sam asks short follow up questions tied to Elise’s account. “Who approved tablet use for this matter?” “Which identity step did the partner complete before opening material?” “Where did the assistant send material from?” “Who receives a request when a device falls outside current practice?” These questions do not make a security judgment. Each one identifies a path, an owner, or a missing record. Sam records answers apart from opinions offered during discussion.

Document device facts with enough detail for a review. Include ownership, device type, primary user group, known enrollment state, and the work performed. “Personally owned tablet used by a partner for document reading” has far more value than “personal device issue.” Keep unknowns visible. If Elise knows unmanaged tablets exist but lacks a count, write “count pending from technology team.” A made up estimate weakens later planning.

Separate policy ownership from technical administration. One person might manage enrollment steps while another interprets firm policy. A practice leader might approve an exception for a matter while a security lead reviews access routes. Ask each attendee to name decisions within their scope. “When a partner requests access from an unlisted device, who decides whether an exception fits current policy?” invites a direct response. Write decision owner, reviewer, and evidence source beside each unresolved question.

Ask identity questions with the same factual discipline. Ask how a user starts access, what happens after a forgotten password, and who provides help when travel causes an issue. Do not assume one sign in route applies to every device. A firm might use one route for employee owned phones and another for devices outside a management program. Your purpose involves making differences visible so internal reviewers face a manageable set of questions.

Follow one document from starting location to device screen. Ask where a user stores notes, whether an assistant takes part, and what happens when a connection ends. Some answers require confirmation from a technical owner. Mark each one with a name and date rather than replacing a gap with an assumption. A review gains trust when participants see which statements come from direct observation and which await verification.

Support work belongs in discovery because a policy needs a workable human process. Ask who helps after a device replacement, how a new assistant receives access, and what response occurs when a device goes missing during travel. Frame questions around a recent situation or a fictional practice situation. “When a tablet was replaced last month, who restored access and what information did they need?” gives a support lead room to describe current steps and handoffs.

After initial fact gathering, schedule a focused architecture session. For Elise’s fictional firm, Sam invites a security lead, policy owner, technology administrator, and representative from the partner group. The meeting purpose reads: record current access routes, confirm missing device information, assign open questions, and identify choices requiring internal review. Sam avoids claims about protection, approval, or suitability. The session prepares the firm’s own decision process.

Send the fictional airport sequence before the meeting. Ask each attendee to mark a missing step or uncertain point. A partner representative might identify travel work unknown to technology staff. A policy owner might name an upcoming internal review. Such comments help Sam separate a gap in evidence from a disagreement about current practice. Both deserve attention, yet they need different next actions.

Keep open questions in their own section of meeting notes. “Who confirms ownership of personally owned tablets?” is an ownership question. “Which access route did the partner use?” is a fact question. Do not combine them. Someone assigned to collect a fact needs a source. Someone assigned to decide a policy question needs a review date and participants. Clear labels reduce circular discussion during a short session.

Sam places a name and date beside every question. A security lead then sees which answer belongs in a formal internal discussion and which answer needs a source check. When a response comes back, add source and date rather than overwriting an earlier note. The history shows why a record changed. Such care becomes useful when two teams remember a travel event differently.

Request a brief inventory before the session. Ask teams to distinguish firm owned devices from personally owned devices. Ask for known user groups, enrollment state, access routes needing review, and a name for every decision owner. Do not demand a flawless inventory. A partial record with sources and visible unknowns gives the group a starting point. An internal owner decides whether more detail is needed before a policy decision.

During the session, start with the fictional airport story: partner, tablet, assistant, document, and access route. Ask attendees to correct sequence before discussing options. Then ask which question needs policy guidance, which needs technical confirmation, and who returns with each answer. Elise assigns the technology administrator to bring a current tablet list to a thirty minute Tuesday review. At the review, each entry receives one label: known, unknown, or outside scope. Sam records the owner beside every unknown entry before closing the call.