Actually force a PIN on the phone (so you have to type a 4 digit password into the phone when you wake it up) is another option. The company I work with forces this on phones that uses it's exchange servers. This idea is that you can't just pick up somebody's phone and start reading confidential email.