8.11

5.6.2.5 Organizations should consider the use of encrypted backups with securely stored and recoverable key material. Decryption keys and/or unencrypted backups should be stored securely and should be
accessible only to authorized employees or officers.

6.1.3.2 (c) Organization using mobility (i.e., cellphones) shall:a. Require separation between work and personal data on mobile devices with access to corporate IT resources and document the details of this separation;
b. Ensure that employees only download mobile device applications (i.e., apps) from the organization’s list of trusted sources.
c. Require that all mobile devices store all sensitive information in a secure, encrypted state.
d. Consider the implementation of an enterprise mobility management solution for all mobile devices or document the risks assumed to the audit, management, and security functionality of mobile
devices by not implementing such a solution.
e. Enforce or educate users to:
– disable automatic connections to open networks;
– avoid connecting to unknown Wi-Fi networks;
– limit the use of Bluetooth and NFC for the exchange of sensitive information ; and
– use corporate Wi-Fi or cellular data network connectivity rather than public Wi-Fi.
f. Consider using secure connectivity (VPN, Virtual Desktop etc.) when connecting to public Wi-Fi networks, or provide the rationale for not doing so