Johnson says businesses need to write formal BYOD policies that include legal documents in which users acknowledge restrictions to what they can do with their devices when connected to corporate networks and authorizing some corporate management of the devices, including the ability to wipe corporate data should they be lost or stolen.