What should a company cell phone policy include?

At minimum: scope and eligibility, acceptable use, security requirements such as passcodes, encryption, and MDM, data and privacy expectations, cost and reimbursement, offboarding covering device return and remote wipe, and enforcement with a signed acknowledgment. Whether devices are company-issued or BYOD changes the emphasis, but every area should be addressed.

BYOD vs company-owned, which is better?

Company-owned gives you full control over security, management, and offboarding, at the cost of buying and managing the fleet. BYOD is cheaper up front but you control less and privacy questions are harder. Many businesses use a hybrid: company-issued for sensitive or heavily-managed roles, BYOD with a stipend for everyone else. The right choice depends on your data sensitivity and IT capacity.

How do we handle phones when an employee leaves?

Your offboarding process should require return of any company-owned device and a remote wipe of work data. For BYOD, use a work profile or container so you can wipe only the business data without touching the employee's personal content. Also handle phone-number porting if a work number needs to move. Spell all of this out in the policy so it is routine, not a scramble.

Who pays for the phone plan?

That is a policy choice. For company-issued phones the company typically pays and sets usage limits. For BYOD, employers commonly offer a monthly stipend or reimbursement, and some states legally require reimbursement for business use of a personal phone. Define the amount and method clearly, and have counsel confirm your state's requirements.

Can we monitor company phones?

Generally you have broad latitude to monitor company-owned devices, and less on personal BYOD devices, but you must disclose it. State in the policy what is monitored and under what circumstances, and separate work data from personal data on BYOD devices. Because monitoring and privacy law varies by state, have an employment attorney review this section.