The device risk is loss and theft rather than network compromise, which makes remote wipe and restrictions on local document storage the controls that matter. Applications that cache documents locally create exposure a browser session does not. For firms permitting personal device use, the BYOD control question and the discovery implications are connected, since a device holding business data may be subject to collection.