Free ebook: NIS2 ready using ISO 27001 best practices
Download ebook

Personnel guidelines for safe usage of mobile devices

Critical
High
Normal
Low

There are separate instructions for staff to use mobile devices. The instructions cover:

  • restrictions on installing software and using various services on your organization's devices
  • procedures for the registration of new devices
  • requirements for physical protection of equipment and installation of updates
  • access control requirements
  • protecting your organization’s data with encryption, malware protection, and backup
  • the ability of the organization to remotely control the device
Connected other frameworks and requirements:
11.2.6: Security of equipment and assets off-premises
ISO 27001
6.2.1: Mobile device policy
ISO 27001
10.1.1: Policy on the use of cryptographic controls
ISO 27001
11.2.8: Unattended user equipment
ISO 27001
12.6.2: Restrictions on software installation
ISO 27001

Process for theft / disappearance of mobile equipment

Critical
High
Normal
Low

Procedures have been established for the theft or loss of mobile devices.

The user may be required to e.g.:

  • change network access codes
  • report the situation to the IT department (and, if necessary, to the police or mobile access provider)
  • change any other credentials that may have been compromised

The organizational process in the event of a device loss may include e.g. clearing the device (at least the contents of the organization) remotely.

Connected other frameworks and requirements:
6.2.1: Mobile device policy
ISO 27001
8.1: User endpoint devices
ISO 27001

Mobile device security policies and their monitoring

Critical
High
Normal
Low

The security policies defined in the mobile device management system aim to protect the organization’s data. For example, to reduce the risk of losing devices, you can specify that the device be locked after 5 minutes of inactivity or that the device be completely wiped after 3 failed login attempts.

It may make sense to test new policies first with a small group of users. Policies also require oversight. You can initially select a setting for policies that informs the administrator of settings that violate the policy, but does not completely block access.

Connected other frameworks and requirements:
6.2.1: Mobile device policy
ISO 27001
8.1: User endpoint devices
ISO 27001

Using a mobile device management system

Critical
High
Normal
Low

Mobile Device Management (MDM) helps secure and manage staff mobile devices, whether they are iPhones, iPads, Android devices, or Windows devices. E.g. a Microsoft 365 subscription includes the basics of mobile device management.

Mobile device management system can be used to e.g. configure device security policies, wipe remotely and get accurate device usage reporting.

Connected other frameworks and requirements:
6.2.1: Mobile device policy
ISO 27001
8.1: User endpoint devices
ISO 27001

Endpoint security management system

Critical
High
Normal
Low

Endpoint security management system can be used to demand the desired security criteria from the devices before they are allowed to connect to the network resources. Devices can be laptops, smartphones, tablets or industry-specific hardware.

Criteria for the use of network resources may include e.g. approved operating system, VPN and antivirus systems, and the timeliness of these updates.

Connected other frameworks and requirements:
13.1.1: Network controls
ISO 27001
6.2.1: Mobile device policy
ISO 27001
PR.PT-4: Communications and control networks
NIST CSF
8.1: User endpoint devices
ISO 27001
9.3 (MIL1): Implement IT and OT Asset Security as an Element of the Cybersecurity Architecture
C2M2

Preventing downloads of confidential information on unsupported devices

Critical
High
Normal
Low

Often, employees want access to data systems as easily as possible - from anywhere, anytime. However, to protect data, you may want to prevent local downloading of data to devices that are not managed, for example, through the organization's mobile device management.

Connected other frameworks and requirements:
6.2.1: Mobile device policy
ISO 27001
13.2.1: Information transfer policies and procedures
ISO 27001
No items found.