3.4.9

6.1.3.2 Organization using mobility (i.e., cellphones) shall:a. Require separation between work and personal data on mobile devices with access to corporate IT resources and document the details of this separation;
b. Ensure that employees only download mobile device applications (i.e., apps) from the organization’s list of trusted sources.
c. Require that all mobile devices store all sensitive information in a secure, encrypted state.
d. Consider the implementation of an enterprise mobility management solution for all mobile devices or document the risks assumed to the audit, management, and security functionality of mobile
devices by not implementing such a solution.
e. Enforce or educate users to:
– disable automatic connections to open networks;
– avoid connecting to unknown Wi-Fi networks;
– limit the use of Bluetooth and NFC for the exchange of sensitive information ; and
– use corporate Wi-Fi or cellular data network connectivity rather than public Wi-Fi.
f. Consider using secure connectivity (VPN, Virtual Desktop etc.) when connecting to public Wi-Fi networks, or provide the rationale for not doing so

4.3.2.1 The organization shall train employees on basic security practices, including a focus on the following practical and easily implementable measures:
a. The use of effective password policies (see Subsection 5.5);
b. Identification of malicious emails and links;
c. Use of approved software;
d. Appropriate usage of the Internet; and
e. Safe use of social media;