Overview and Purpose

Mobile computing devices such as laptop computers, PDAs, and multi-function cell phones, increase the flexibility, range, and business potential of day-to-day business processes. However, the use of these devices can also increase the risk exposure of [variable: Covered Organization] networks and Information Resources.

This policy seeks to protect the integrity, availability, and confidentiality of [variable: Covered Organization] networks, systems, and information by establishing rules for the use and network connectivity of mobile computing devices.

Coverage

All individuals that use or manage mobile or portable computing devices to access [variable: Covered Organization] Information Resources.

Definitions

General Terminology:

• Information Resources

Roles and Functions

• Information Resources Manager (IRM)
• Information Security Officer (ISO)
• Information Services Department

Policy

• Personnel may use only approved mobile computing devices to access [variable: Covered Organization] Information Resources.
• Mobile computing functionality must be password protected.
• [variable: Covered Organization] data should not be stored on mobile computing devices. However, in the event that there is no alternative to local storage, all sensitive [variable: Covered Organization] data must be encrypted using approved encryption techniques.
• [variable: Covered Organization] data must not be transmitted via wireless connections to or from a mobile computing device, unless the connection uses approved, secure wireless transmission protocols and approved encryption techniques.
• All remote access (dial in services) to [variable: Covered Organization] must be through an approved modem pool or via an Internet Service Provider (ISP).
• Non-[variable: Covered Organization] computer systems that require network connectivity must conform to [variable: Covered Organization] IS Standards and must be approved in writing by the {organization} ISO.
• Unattended mobile computing devices must be physically secured: locked in an office, locked in a desk drawer or filing cabinet, or locked to a desk or cabinet via a cable lock system.
  • Mobile computing devices must not be left unattended overnight, either on [variable: Covered Organization] premises or offsite.
  • In particular, mobile computing devices must not be left in parked vehicles overnight or for a period of more than [variable: time period].

Enforcement

Gross negligence or willful disregard of this standard may result in disciplinary action which may include termination for employees and temporaries; a termination of employment relations in the case of contractors or consultants; dismissal for interns and volunteers; or suspension or expulsion in the case of a student. Additionally, individuals are subject to loss of [variable: covered Organization] Information Resources access privileges, civil, and criminal prosecution.

Supporting Documentation

This policy is supported by the following rules, standards, and procedures:

• [variable: internal documents (with links, if available)]
• [variable: external documents (with links, if available)]

Policy Support Contact

• [variable: title (not personal name) of role responsible for overseeing this procedure]
• [variable: Contact information of office responsible for overseeing this procedure]

References

Research Resources

• Computer Security Act of 1987
• Federal Agency Security Practices, US Government, National Institute of Standards and Technology (NIST