Mobile Device Management Procedure

1. Purpose

This procedure sets out the steps that IT and users follow to issue, enrol, configure, support, change, recover and retire mobile devices that access Organisation information. It puts the Mobile Device and Teleworking Policy into practice and keeps data on phones, tablets and similar devices under the Organisation's control whoever owns the hardware.

2. Scope

• In scope: smartphones, tablets, laptops that are managed through the mobile device management tool, wearable devices that receive Organisation data, and removable accessories that store data.
• In scope: devices owned by the Organisation and personal devices approved for work under the bring-your-own-device rules, and everyone who uses them, including contractors.
• Out of scope: fixed desktop computers and servers, which follow the Asset Management Procedure and the Secure Configuration Policy; personal devices that never touch Organisation data.

3. Terms and Definitions

4. Roles and Responsibilities

5. Acquisition and Ownership

Corporate devices belong to the Organisation and are issued for work. Each device is recorded in the asset register with a named owner and is used according to the Acceptable Usage Policy.

1. RequestThe user's manager submits a device request in the ticketing tool stating role, business need and data to be accessed. Input: request form (Annexure A).
2. ApproveThe department head approves cost and need; IT confirms the model is on the supported list. Target: [2 working days].
3. ProcureProcurement buys from an approved supplier. Only devices with current vendor security updates and hardware encryption support are allowed. Lead time: [10 working days].
4. PrepareService desk records the serial number and asset tag, installs the baseline, enrols the device in the MDM and tests encryption and lock.
5. IssueThe user signs the acknowledgement of terms of use and receives a briefing on loss reporting, apps, travel and updates. Evidence: signed form.
6. ReviewOwnership and need are reconfirmed during the [annual] asset review and on any role change.

• Devices are issued for [3 years] unless a support or security reason requires earlier replacement.
• Personal accounts, personal cloud backup and personal messaging for work content are not permitted on corporate devices unless the Acceptable Usage Policy allows them.
• Devices bought outside this process are not connected to Organisation resources.

6. Mobile Device Management Solution

6.1 Enrolment and baseline

No device may reach email, files, collaboration tools or internal applications until it is enrolled and compliant. The MDM enforces the settings below and reports compliance to the access gateway.

6.2 Operations

• The service desk reviews the MDM compliance dashboard [daily]. A non-compliant device is notified at once and loses access to work data after [24 hours] unless fixed.
• Updates to the baseline are tested on a pilot group of [10] devices before wider release.
• Administrator roles in the MDM are limited to named staff, protected by multi-factor authentication, and reviewed [quarterly].
• MDM logs are sent to the central logging platform under the Logging and Monitoring Procedure.
• The device register is reconciled with the MDM inventory [monthly]; devices unseen for [30 days] are investigated.

6.3 Travel and high-risk locations

Staff travelling to locations the Head of IT Security marks as high risk receive a clean loan device with only the data needed for the trip. They must not carry Restricted data, must keep the device with them, and must report any seizure or inspection of the device on return. The device is re-imaged afterwards.

7. Bring Your Own Device

Use of personal devices is a privilege granted to eligible roles. It is optional for staff and can be withdrawn. Contractors may use BYOD only where the contract allows it.

1. ApplyThe user asks through the ticketing tool and reads the BYOD terms (Annexure B).
2. Check eligibilityThe line manager confirms the role; the Head of IT Security confirms the device model and operating system version meet the baseline.
3. ConsentThe user signs consent that the MDM manages the work container, can wipe it, and sees only device model, operating system, compliance state and installed work apps - not personal content, location or personal messages.
4. EnrolThe service desk enrols the device with a work profile. Work data stays inside the container.
5. OperateThe user keeps the device compliant, does not share it for work purposes, and does not allow another person to use the work profile.
6. ExitOn leaving, role change or withdrawal, the service desk removes the work container and verifies removal. Evidence: MDM wipe log.

• The Organisation is not responsible for loss of personal content or for the cost of the device, repair, or data plan, unless the agreement states otherwise.
• A BYOD device may be inspected by IT only in the presence of the owner and only for work data, or by law enforcement under legal process.
• If a personal device cannot meet the baseline, the user is offered a corporate device where the role justifies it, or access is limited to web-only applications.

8. Change, Loss and Return of Devices

8.1 Change of device or user

1. NotifyThe user tells the service desk before changing, repairing or selling a device, or when the role changes.
2. TransferIT enrols the new device and confirms the work profile works. Data is migrated through managed channels, not copied manually.
3. RetireSelective wipe on the old BYOD device; full wipe on the old corporate device. Update the register.
4. RepairCorporate devices are repaired only by approved providers, after data is removed or encrypted. Record the service in the device register.

8.2 Loss or theft

A lost or stolen device is a security incident. The user reports it to the service desk by phone or message, available [24 hours a day], within [1 hour] of noticing. The service desk takes the following steps without waiting for the user's manager.

8.3 Return at end of use

• Corporate devices are returned within [5 working days] of leaving or role change, with accessories. The service desk wipes, checks the condition and updates the register.
• Devices that cannot be returned are blocked and wiped remotely, and the case is reported to HR for follow-up.
• Devices retired from use follow the media disposal methods in the Information Classification and Handling Procedure and the Asset Disposal Process.

9. Measures

10. Records and Evidence

Annexure A: Mobile device request and issue form

Annexure B: BYOD consent and registration

Annexure C: Lost or stolen device report

11. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

12. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

13. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• Mobile Device and Teleworking Policy
• Acceptable Usage Policy
• Asset Management Procedure
• Information Classification and Handling Procedure
• Cryptography Procedure
• Incident Management Procedure