We're days away from seeing the first batch of Apple Watches appear on wrists, and IT admins need to get ready for them to make an appearance in workplaces.
That said, there's not a lot that IT admins can do to control the Apple Watch in the workplace. In fact, the latest update to the Apple Configurator - Apple's mobile device management tool - only adds one restriction related to the Apple Watch. Called "Force Apple Watch wrist detection," this new restriction can be used to prevent notifications from being sent to the Apple Watch unless it is being worn. This would prevent notifications being sent to an unattended Apple Watch.
Is this enough? Yes. Since the Apple Watch isn't a standalone device and instead relies on the iPhone, if the watch is separated from the handset, it then no longer poses a security risk.
The only way for admins to totally prevent an Apple Watch from connecting to a managed iPhone would be to disable Wi-Fi and Bluetooth, which would be a very draconian move that would make allowing iPhones pointless.