Mobile Devices: Mobile devices, such as smart phones and tablet computers, are important tools for the organisation and their use is supported to achieve business goals. However mobile devices also represent a significant risk to information security and data security because if the appropriate security applications and procedures are not applied, they can be a conduit for unauthorised access to the organisation’s data and IT infrastructure. This can subsequently lead to data leakage and system infection. This organisation has a requirement to protect its information assets in order to safeguard its customers, intellectual property and reputation. Scope All mobile devices, whether owned by this organisation or owned by employees, that have access to corporate networks, data and systems, not including corporate IT-managed laptops, this includes smart phones and tablet computers. Exemptions: Where there is a business need to be exempted from this policy (too costly, too complex, adversely impacting other business requirements) a risk assessment must be conducted and authorised by security management. Technical Requirements Devices must use the following Operating Systems: Android 2.2 or later, 105 4.x or later. Devices must store all user-saved passwords in an encrypted password store. Devices must be configured with a secure password that complies with this organisations password policy. This password must not be the same as any other credentials used within the organisation. With the exception of devices managed by IT, devices are not allowed to be connected directly to the internal corporate network. User Requirements must only load data essential to their role onto their mobile device(s). Users must report all lost or stolen devices to the Facilities manager immediately. If a user suspects that unauthorised access to organisation data has taken place via a mobile device the user must report the incident to their manager Continued failure to comply may lead to a disciplinary action being taken. Related policies Security and Public Relations
Mobile Devices: Mobile devices, such as smart phones and tablet computers, are important tools for the organisation and their use is supported to achieve business goals. However mobile devices also represent a significant risk to information security and data security because if the appropriate security applications and procedures are not applied, they can be a conduit for unauthorised access to the organisation’s data and IT infrastructure. This can subsequently lead to data leakage and system infection. This organisation has a requirement to protect its information assets in order to safeguard its customers, intellectual property and reputation. Scope All mobile devices, whether owned by this organisation or owned by employees, that have access to corporate networks, data and systems, not including corporate IT-managed laptops, this includes smart phones and tablet computers. Exemptions: Where there is a business need to be exempted from this policy (too costly, too complex, adversely impacting other business requirements) a risk assessment must be conducted and authorised by security management. Technical Requirements Devices must use the following Operating Systems: Android 2.2 or later, 105 4.x or later. Devices must store all user-saved passwords in an encrypted password store. Devices must be configured with a secure password that complies with this organisations password policy. This password must not be the same as any other credentials used within the organisation. With the exception of devices managed by IT, devices are not allowed to be connected directly to the internal corporate network. User Requirements must only load data essential to their role onto their mobile device(s). Users must report all lost or stolen devices to the Facilities manager immediately. If a user suspects that unauthorised access to organisation data has taken place via a mobile device the user must report the incident to their manager Continued failure to comply may lead to a disciplinary action being taken. Related policies Security and Public Relations