Physical Security

By nature, a mobile device is more susceptible to loss or theft than a non-mobile system. The company should carefully consider the physical security of its mobile devices and take appropriate protective measures, including the following:

• Laptop locks and cables can be used to secure laptops when in the office or other fixed locations.

• Mobile devices should be kept out of sight when not in use.

• Care should be given when using or transporting mobile devices in busy areas.

• As a general rule, mobile devices must not be stored in cars. If the situation leaves no other viable alternatives, the device must be stored in the trunk, with the interior trunk release locked; or in a lockable compartment such as a glove box.

• The company should evaluate the data that will be stored on mobile devices and consider remote wipe/remote delete technology. This technology allows a user or administrator to make the data on the mobile device unrecoverable.

• The company should continue to monitor the market for physical security products for mobile devices, as it is constantly evolving.

 

Data Security

If a mobile device is lost or stolen, the data security controls that were implemented on the device are the last line of defense for protecting company data. The following sections specify the company's requirements for data security as it relates to mobile devices.

1. Laptops: Whole disk encryption is required. Laptops must require a username and password or biometrics for login.

2. Smartphones/Tablets: Use of encryption is required on smartphones and tablets. Smartphones and tablets must require a PIN or password for login.

3. Mobile Storage Media: This section covers any USB drive, flash drive, memory stick or other personal data storage media. Encryption is required on these devices when they contain company information. Data should be transferred to permanent storage and deleted from the mobile storage media as soon as possible.

4. Portable Media Players: No company data can be stored on personal media players.

5. Other Mobile Devices: Unless specifically addressed by this policy, storing company data on other mobile devices, or connecting such devices to company systems, is expressly prohibited. Questions or requests for clarification on what is and is not covered should be directed to the Executive Team.

 

Connecting to Unsecured Networks

Users must not connect to any outside network without a secure, up-to-date software firewall configured on the mobile computer. Examples of unsecured networks would typically, but not always, relate to Internet access, such as access provided from a home network, access provided by a hotel, an open or for-pay wireless hotspot, a convention network, or any other network not under direct control of the company.

​

The use of a software VPN is strongly encouraged on unsecured networks as well.

​

General Guidelines

The following guidelines apply to the use of mobile devices:

• Loss, Theft, or other security incident related to a company-provided mobile device must be reported promptly.

• Confidential data should not be stored on mobile devices unless it is absolutely necessary. If confidential data is stored on a mobile device it must be appropriately secured and comply with the Confidential Data policy.

• Data stored on mobile devices must be securely disposed of in accordance with the Data Classification Policy.

• Users are not to store company data on non-company-provided mobile equipment. This does not include simple contact information, such as phone numbers and email addresses, stored in an address book on a personal phone or PDA.

 

Audits

The company must conduct periodic reviews to ensure policy compliance. A sampling of mobile devices must be taken and audited against this policy twice per calendar year.

 

Applicability of Other Policies

This document is part of the company's cohesive set of security policies. Other policies may apply to the topics covered in this document and as such the applicable policies should be reviewed as needed.