This is not mainly about SIM security as far as I understood. It's more about employees visiting phishing sites on their phone. Or their phone getting hacked e

This is not mainly about SIM security as far as I understood. It's more about employees visiting phishing sites on their phone. Or their phone getting hacked exposing mail correspondence, or 2FA getting hacked etc. In the way it's presented it's still the wrong solution IMHO. If security matters and the work requires a phone do not allow BYOD. Provide a phone. For such a phone this might be an okay solution, not for a private phone. If a phone isn't strictly required remove phones completely and strictly out of the loop. This is beneficial both for security in more ways then this sim service provides and for the mental health of your employee. Make it clear that even if they are called because of an work emergency they are contractual bound not to process it on the phone but instead switch to a employer provided device no mater who calls and which situation it is. PS: Also fire any manager or even the CTO who tries to pressure employees into not keeping the rule, make it an automatic firing through a contract clause.