A safer phone.
A clearer threat model.

For a business buying phones, a credible procurement record is more useful than an employee trying to inspect internal components. Use authorised suppliers and repairs, maintain an inventory and make unexpected replacements or unrequested accessories easy to report.

Do not ask staff to investigate a suspected physical hazard themselves. Route a credible safety concern through the organisation’s established safety and security arrangements. Keep that exceptional situation distinct from ordinary software troubleshooting.

Keep the operating system and applications supported and updated. Review the apps installed, the permissions they hold and the work information they can reach. A device that no longer receives relevant fixes may need replacement rather than another policy reminder.

Use a strong screen lock and appropriate account protection. Enable theft-related features supported by the device and version, and reduce unnecessary sensitive content on the locked screen. A handset can be locked while visible notifications still disclose useful information.

Apple’s Stolen Device Protection and Google’s supported theft-protection controls add checks around certain sensitive changes or theft situations. Availability and behaviour vary by device, software and settings. Check the manufacturer’s current instructions instead of assuming a feature is active everywhere.

The original post pointed readers to the NSA’s longstanding Mobile Device Best Practices guide. It remains a useful historical reference for basic habits; it should not be presented as a newly issued May 2024 document or a promise that a weekly restart removes all threats.

The better operating habit is to know what each precaution changes and what it leaves unresolved. Staff can follow a short, workable set of actions when those actions have a clear purpose.

Keep account recovery and organisational reporting available independently of the normal handset. Important accounts should not depend on one person having one device, with no controlled alternative when it is missing.

For work use, agree who can revoke sessions, lock access or approve a wipe, and how privacy and ownership affect that authority. An employee-owned device and an organisation-owned device may require different arrangements. Test the actual route out of hours.

Executives, journalists, activists, lawyers and others can face highly targeted threats because of their role or circumstances. Do not assume everyone needs the same restrictive setup, or that ordinary consumer habits are sufficient for a person with a credible targeted-risk concern.

Apple’s current mercenary-spyware guidance recommends specialist help for recipients of relevant threat notifications and describes optional stronger protections, including Lockdown Mode, for appropriate situations. Such modes restrict normal functions; they are a risk-based choice, not a universal guarantee.

Use the individual’s role, travel, sensitive information and credible threat evidence to decide the support required. Keep a route for confidential reporting and expert response rather than asking the person to diagnose spyware from a battery symptom or a checklist.