Mobile Device and Teleworking Policy

1. Purpose

Work now happens on phones in taxis, laptops in homes and tablets in client sites. Each of these places sits outside the Organisation's walls and its network, so protection must travel with the device and the person. This policy sets the conditions under which mobile devices may hold or reach Organisation information, and the rules for working remotely, so that flexibility does not create unmanaged risk.

The device enrolment, configuration and support steps are in the Mobile Device Management Procedure.

2. Scope

The policy covers all devices and all people who use mobile or remote means to reach Organisation information.

• Devices in scope: Organisation-owned laptops, smartphones, tablets, smart watches able to read corporate data, and removable media.
• Devices in scope: personally owned devices approved for work, and, for restricted purposes only, shared or public devices.
• Users in scope: employees, contractors, consultants, interns, and supplier staff who use such devices to reach the Organisation's information, and people who work from home or another remote place for any part of their week.
• Out of scope: devices that never connect to Organisation systems or hold its information, and the physical security of the Organisation's own sites, which is in the Physical and Environmental Controls Policy.

3. Terms and definitions

4. Roles and Responsibilities

5. Policy Statements

5.1 Use of personally owned mobile devices

5.1.1 Eligibility and approval

• A personally owned device may be used for work only after the person's line manager and IT approve it, the person accepts this policy in writing, and the device is enrolled in MDM.
• Only device models and operating system versions on the approved list may be enrolled. Devices that are rooted, jailbroken or running unsupported software are refused.
• Contractors and supplier staff may use their own devices only where the agreement allows and access is limited to the work container or a virtual desktop.
• Organisation systems classed Restricted are not available on personally owned devices.

5.1.2 Security considerations

• The device must be protected by a passcode of at least [6 digits] or biometric with passcode fallback, auto-lock within [5 minutes], and full device encryption turned on.
• The Organisation's data lives in the work container or approved apps only. Copying data to personal apps, personal cloud storage, personal email or the local photo library is blocked or prohibited.
• Operating system and apps must be updated within [14 days] of a security update release. The MDM tool blocks access from devices that fall behind or fail checks.
• Anti-malware or mobile threat defence is installed where the platform supports it, and only apps from official stores are installed.
• Family members and other people must not use the device while signed into Organisation apps, and the work container must not be shared.
• Backups of the device must not include the work container to personal cloud accounts.

5.1.3 Support

IT supports only the work container and the Organisation's apps on personal devices. Hardware repair, personal apps and the device itself are the owner's responsibility. The Organisation does not provide replacement devices and does not cover the cost of the device except as stated in an allowance policy [if any].

5.1.4 Ongoing device management

• MDM checks compliance continuously and reports status daily. Non-compliant devices lose access until fixed.
• The Organisation can selectively wipe the work container on loss, theft, leaving, suspected compromise or breach of policy, without notice where urgent.
• A full wipe of a personal device is used only if selective wipe is not possible and the owner agrees, or the owner is advised first and has had the chance to back up personal data.
• Before replacing, selling, repairing or handing the device on, the user must contact IT to remove the work container.

5.1.5 Periodic audit and non-compliance remediation

IT reviews the list of enrolled personal devices [every 3 months] against approvals and HR records, removes devices no longer needed and checks for compliance drift. Where a device is non-compliant, the process in the table applies.

5.1.6 Liability and privacy of the owner

• The user is responsible for the device and for any personal data on it. The Organisation is not liable for loss of personal data resulting from a wipe carried out under this policy.
• The Organisation monitors only the work container and device compliance state. It does not read personal messages, photos or browsing, and does not track location except to locate a device the user has reported lost, with the user's consent.
• Users who leave must allow removal of the work container on their last day. Costs of data plans are the user's unless an allowance policy applies.

5.2 Use of Organisation-owned mobile devices

5.2.1 Securing the corporate network and data

• Mobile devices connect to internal systems only through the approved secure channel with multi-factor authentication, as set out in the Access Control Policy.
• Devices must not be connected to unapproved networks or tethered to personal hotspots for access to Restricted systems.
• Public wireless networks may be used only through the approved virtual private network. Automatic joining of open networks is turned off.
• Bluetooth and near-field features are turned off when not needed, and devices are not paired with unknown equipment.

5.2.2 Limiting theft and data loss

• Laptops are encrypted at rest with a managed key. Phones and tablets are encrypted by default and enforced by MDM.
• Devices are never left unattended in cars, public places or checked baggage. When travelling, laptops are carried as hand luggage and screens are used with privacy filters in public.
• Hotel safes are used where practical. Devices left in rooms are locked away and powered off.
• Local storage of Confidential information on mobile devices is minimised. Files are opened from, and saved to, approved storage rather than copied to the device.
• Confidential and Restricted information is not to be discussed on a call or displayed on a screen where others can listen or watch.

5.2.3 Hardware and data recovery

Organisation-owned devices are backed up through approved services to Organisation storage. Users may not rely on local copies. Loss or damage is reported to the service desk, and a replacement is issued after the incident is logged.

5.2.4 Secure disposal and reuse

Devices returned or retired are wiped by IT in line with the Asset Disposal Process before reuse, sale or recycling, and the register is updated. Users must not wipe, sell, give away or repair Organisation-owned devices themselves.

5.2.5 User responsibilities

• Lock the screen whenever leaving the device, even for a moment.
• Never share the device, passcode or MFA factor with anyone, including family.
• Install only apps approved or obtainable through the Organisation's app catalogue.
• Report lost, stolen or suspicious devices to the service desk within [1 hour] of discovering it, day or night.
• Return the device within [5 working days] of being asked.
• Keep the device physically in good condition, and use only the issued charger and accessories where possible.

5.3 Minimum requirements for teleworking

5.3.1 Approval and eligibility

• Teleworking is allowed for roles where the work can be done safely away from the office, as approved by the line manager and HR. Roles that handle Restricted information may need conditions or exclusions.
• Each teleworker agrees to this policy and completes a short remote working self-assessment on the location and equipment.
• Working from outside the country of employment needs prior written approval of the line manager, HR and Legal, because tax, employment, data protection and export rules may apply.

5.3.2 Equipment and network

• Teleworkers use Organisation-issued devices wherever the role needs access to Confidential information. BYOD is allowed only as described above.
• The home router must have a changed administrator password, current firmware and encryption at least [WPA2 or better] on its wireless network. Guests and family devices should be on a separate network where possible.
• Smart speakers, cameras and voice assistants in the work area should be switched off during Confidential calls.
• Organisation devices are used only for work by the person assigned.

5.3.3 Workspace and physical security

• The work location must allow private, undisturbed work. Screens must not be visible from windows or to household members and visitors.
• Papers and removable media with Confidential information are kept locked away. Printing at home is avoided and, if unavoidable, printed material is shredded or brought back for secure disposal.
• Devices and papers are locked away when not in use and not left in vehicles.

5.3.4 Remote connections and sessions

• Access to internal systems is only through the approved virtual private network, zero-trust gateway or virtual desktop, with MFA.
• Sessions disconnect after [30 minutes] idle. Split tunnelling is permitted only where the Head of IT Security has approved it.
• Files are worked on in approved cloud or repository locations rather than local folders, and sync of Confidential folders to personal computers is blocked.

5.3.5 Calls, meetings and communication

• Only approved conferencing and messaging tools are used for business. Meeting links for Confidential discussions require a lobby or passcode.
• Participants are verified before sensitive information is shared; recording requires consent and follows the Information Classification and Handling Policy.
• Background and shared-screen content is checked before presenting.

5.3.6 Incident reporting and monitoring

Teleworkers report suspected incidents, lost items and unusual messages immediately. Remote work activity is subject to the same logging and monitoring as office work, within the limits of law and the Acceptable Usage Policy. Teleworkers must allow IT to inspect, update or recover Organisation devices when needed.

5.3.7 Health, safety and working time

The Organisation's duty of care continues for teleworkers. Teleworkers report accidents that occur while working, keep to agreed working hours and take breaks. Line managers check in regularly. Security fatigue is a risk: tiredness leads to errors, so pressure to respond outside hours must not cause staff to bypass controls.

6. Minimum Device Security Standard

7. What May Be Done on Which Device

The table sets the highest classification that may be accessed or held on each type of device. Anything not listed is not permitted.

8. Enrolment and Exit of Devices

Enrolment and exit follow set steps so that no device holds Organisation data without being managed, and none keeps it after the person leaves.

1. RequestThe user raises a request in [the ticketing tool] naming the device, the business reason and the manager's approval. Target: reviewed in [2 working days].
2. CheckIT confirms that the model and operating system version are on the approved list and that the user has accepted the policy.
3. EnrolThe user installs the management profile or work container under IT guidance. IT applies the security settings and checks the device is compliant. Target: [1 working day].
4. UseThe device is monitored for compliance state. Access follows the Access Control Policy and the device table in this policy.
5. ReviewContinuing need is confirmed by the line manager [every 12 months] or the device is withdrawn.
6. ExitOn leaving the Organisation, changing device, or withdrawing consent, IT removes the work container or wipes the managed device on the last working day, and the register is updated.

• A user who refuses enrolment, or who removes the management profile, loses access to Organisation systems on that device immediately.
• Devices lost to the user before exit (for example sold or broken) are reported so that tokens and sessions can be revoked.

9. Lost, Stolen or Compromised Devices

Speed matters more than blame. Whoever finds that a device is missing, or suspects that it or its account has been compromised, follows these steps.

1. ReportTell the service desk by phone or [the incident reporting channel] within [1 hour] of discovery, giving the device, last place seen, and whether it was locked.
2. ContainThe service desk locks the device and disables its sessions and tokens at once. The Head of IT Security decides within [4 hours] whether to wipe it remotely or selectively.
3. ResetThe user changes passwords on accounts used on the device from another trusted device. Certificates and keys on the device are revoked.
4. AssessThe Head of IT Security determines what information was held, its classification and whether personal data was affected, and opens an incident under the Information Security Incident Management Policy.
5. NotifyWhere law or contract requires, Legal and the data protection lead decide on notices to authorities and customers, including any CERT-In notice within [6 hours] of noticing a reportable incident [confirm the current requirement].
6. Replace and learnA replacement is issued after the incident is logged. The cause is reviewed and recorded, and lessons are fed into awareness material.

10. Public Computers, Printing and Shared Spaces

• Organisation accounts are not signed into on public or shared computers, kiosks or business-centre machines. If unavoidable, only web-based access to Internal information through a private session is allowed, with sign-out and clearing of history after.
• Co-working spaces and cafes: users must use a privacy screen, the approved VPN, and keep devices within sight at all times. Calls with Confidential content are not made there.
• Printing in public or home locations is avoided for anything above Internal.
• Photographs of screens, whiteboards and documents containing Confidential content are not taken with personal phones.

11. Travel and High-Risk Locations

• Before international travel, users tell their manager and IT where they are going and take only the data and devices they need. Travel to locations designated high risk by the Head of IT Security needs clean loaner devices, which are inspected and reset on return.
• Devices crossing borders are powered off and stored with encryption active. If asked to unlock a device by authorities, users follow the guidance from Legal and report afterwards.
• Public USB charging points and unknown cables are not used. Users carry their own chargers and power banks.
• Credentials are changed after travel to high-risk locations if the device was out of sight.

12. Compliance and monitoring

IT security reports on the measures below [monthly] and top management reviews them [quarterly].

13. Records and evidence

• Approvals, signed acknowledgements and remote working self-assessments: employment plus [3 years].
• MDM enrolment, compliance, wipe and lock logs: [12 months].
• Lost device incident records: [3 years].
• Quarterly device audit results and exceptions: [3 years].

Annexure A: Personal device use request and acknowledgement

14. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

15. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

16. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• Mobile Device Management Procedure
• Acceptable Usage Policy
• Access Control Policy
• Information Classification and Handling Policy
• Cryptography Policy
• Information Security Incident Management Policy
• Physical and Environmental Controls Policy
• Malware Protection Policy