A mid-rollout check-up turned a stalled personal-phone debate into a working pilot
A regional commercial general contractor. Outcome verified
The problem
Four months after a posture assessment, a regional commercial general contractor's IT team had started rolling out device management, laptop encryption and stronger sign-in on its own. Progress was real, but the team could not tell whether it was building on the right foundation or leaving gaps, and the business had not decided how much control to impose on personal phones, so the mobile side had stalled.
Why it mattered
Most registered devices were unmanaged, nearly all cloud sign-ins came from unmanaged devices, disk encryption was not enforced, and company email lived on personal phones nobody could wipe.
What we did
Instead of another assessment, Vizius had a senior cloud engineer review the actual consoles against CIS benchmarks and turn the gaps into a rollout plan: finish enrollments, add compliance policies, then use conditional access to block anything unmanaged. For personal phones it recommended protecting only the company-data container, sidestepping the privacy standoff.
What changed
The plan was carried out. A personal-device pilot ran from November 2023 to January 2024 with conditional access and app-protection policies in force, and issues raised by pilot users were resolved before wider rollout.
- Construction and engineering
- Midsize company
- CIS Controls