The use of mobile devices in business is increasing as employees use them for communications, creating, and editing documents, storage and retrieval of data files, and browsing the Internet. Mobile device purchases now exceed personal computers. While mobile increases worker agility and allows them to work remotely, the pervasiveness and evolution of these devices creates a special threat because existing policies and controls are not sufficiently broad to cover the new threats these devices pose. Most organizations have failed to address these security issues through formal policies or create specific controls to reduce their likelihood. This article argues for the importance of enhanced mobile device policies and controls, suggests specific policies and controls, and presents a mobile device security model.