## 1 Introduction
The term \"other security and privacy criteria\" indicates additional privacy requirements in BYOD security, such as confidentiality, integrity, availability, authenticity, privacy preservation, non-repudiation, and attack detection. Furthermore, [PERSON] et al. [16] presented a thorough review of compliance theories that are used to interpret and predict security practices in the Bring Your Own Device (BYOD) sector. However, they did not conduct an assessment of technologies in relation to security and privacy standards. Instead, their primary focus was largely on the theoretical aspects of the subject. Additionally, [PERSON] et al. [17] highlighted significant security problems associated with hospital BYOD practices but did not extensively address the identified concerns by analyzing technologies. While several survey studies have contributed to understanding BYOD's privacy and security challenges, most of them have provided limited information on the inherent privacy and security concerns of BYOD. Furthermore, many of these studies examined only a subset of the problem or conducted a review during the early stages of BYOD adoption. In [18], the researchers conducted a comprehensive review of attack detection strategies that utilize machine learning. However, they did not delve into other aspects related to privacy needs. To put it another way, while they extensively studied how machine learning can be used to identify cyber attacks, they did not explore other crucial components of privacy, such as data protection, anonymity, and user consent. Table 1 provides an overview of the main focus and limitations of some of the earliest (pre-2023) literature on BYOD security. Overall, while these studies have made strides in offering access control solutions and risk analyses, they exhibit limitations. Particularly, they do not critically evaluate the studies in terms of their contribution to satisfying the privacy requirements essential for BYOD systems. Therefore, this paper extensively reviews security policies and access control in three security policy layers. It evaluates the effectiveness of existing security policies and access control mechanisms in meeting privacy requirements. The study contributes to understanding privacy-focused security measures in BYOD environments and informs future research and improvements in security policies and access control strategies. To ensure a systematic approach, we developed a review protocol that outlines the critical phases necessary to achieve the objectives of this study. The paper focuses on seven critical security and privacy criteria within the three layers of secure BYOD control policies designed for enterprises adopting BYOD practices. These criteria include confidentiality, integrity, availability, authenticity, privacy preservation, non-repudiation, and attack detection. Achieving these criteria ensures the system can eliminate potential privacy and security vulnerabilities and comply with regulatory guidelines [5; 22]. The process of this study will ensure unbiased data retrieval and thorough search procedures. The contributions of this study to the overall review can be summarized as follows:  
* Identifies privacy and security criteria needed in the BYOD policy setting. * Analyses existing policy techniques based on privacy and security requirements in three security policy layers. * Introduces a novel taxonomy that categorizes policy techniques into three layers according to their alignment with privacy and security requirements. This taxonomy provides a structured framework for understanding and organizing policy techniques, contributing to the existing knowledge in the field. * Identifies and discusses the current trends in technology related to policy techniques by examining the technological advancements within each layer. * Addresses the measures used to evaluate the effectiveness of policy techniques, mainly through performance analysis, by discussing these evaluation measures.