In what circumstances can a company "Legally" install spyware on a private device?

Hypothetical situation: Let's say your employer is a defense contractor and installed spyware on your phone for "legitimate business interest" of "security" without your knowledge. Is there any law, directive or rules authorizing this? My "research" has been confusing, getting conflicting answers. For instance: The FTC will investigate a company that programs Industrial Servalliance Exploits and will cite that these "exploits" where designed for defense contractors employee monitoring, but no further explanation is given. (WTF)
Does anyone know... anything? (Because …

business can contractor defense defense contractor device employer ftc install instance interest knowledge law phone privacy private research rules security spyware