A reference model of BYOD security policy at higher learning institutions

The widespread adoption of BYOD in Higher Learning Institutions has introduced growing security concerns, particularly involving the protection of both personal and institutional data, underscoring the need for a comprehensive reference model to guide effective BYOD Security Policy formulation. Despite the prevalence of BYOD practices in Malaysia, existing policies remain fragmented and lack a structured framework tailored to the local educational context. Therefore, this study aimed to explore the implementation of BYOD Security Policies in Malaysian public HLIs, with the objectives of examining current safeguarding practices, understanding policy development processes, and identifying the essential elements needed for a robust reference model. Using a qualitative case study approach, purposive sampling was employed to select 10 ICT top‑management representatives from 10 public HLIs across Malaysia. Data were collected through document reviews and analysis, semi‑structured online interviews, and security expert validation, and were analyzed inductively using thematic analysis. The findings uncovered four key components that form the foundation of a new reference model for BYOD Security Policy: Personal Data, Corporate Data, Governance, and Audit/Quality. This study ultimately proposes a new BYOD Security Policy reference model tailored for Malaysian HLIs, extending existing governance and ISC frameworks while providing practical insights to strengthen policy development, enhance security governance, and support better management of BYOD environments in educational institutions.