6.1.3.2

Mobile Devices

a. require separation between work and personal data on mobile devices with access to corporate IT resources and document the details of this separation;

b. ensure that employees only download mobile device applications (i.e., apps) from the organization’s list of trusted sources;

c. require that all mobile devices store all sensitive information in a secure, encrypted state;

d. implement an enterprise mobility management solution for all mobile devices or document the risks assumed to the audit, management, and security functionality of mobile devices by not implementing such a solution;

e. enforce users to:     

1. – disable automatic connections to open networks;
2. – avoid connecting to untrusted Wi-Fi networks;
3. – limit the use of Bluetooth and NFC for the exchange of sensitive information;
4. – use corporate Wi-Fi or cellular data network connectivity rather than public Wi-Fi; and
5. – use secure connectivity (VPN, Virtual Desktop etc.) when connecting to public Wi-Fi networks or provide the rationale for not doing so.