SYS.3.1 Laptops

The aspects employees must consider when making mobile use of laptops MUST be clearly defined. In particular, the laptops available for mobile use, who is allowed to use them, and what basic security safeguards should be followed MUST be specified. The users MUST be informed of these rules.

A personal firewall MUST be activated on all laptops if they are to be used outside of an organisation's network. The filter rules for personal firewalls MUST be configured as restrictively as possible. They MUST be tested regularly. Personal firewalls MUST be configured to avoid pestering users with warnings they are not able to interpret.

When using publicly available networks, users MUST ONLY access their organisation's internal network through secure communication channels.

Security policies that govern how laptops may be used SHOULD be established. Users SHOULD be made aware of the protection needs for laptops and the data stored on them. They SHOULD also be made aware of the specific threats at hand and the corresponding requirements for use. Furthermore, they SHOULD be informed of the types of information they may process on laptops.

If different people take turns using the same laptops, secure methods of issuing laptops to employees SHOULD be defined. Their safe return SHOULD also be regulated. When a laptop changes users, any sensitive data SHOULD be securely deleted. If a laptop is not reset upon changing users, care SHOULD be taken to ensure that there is no malware on the corresponding IT system or any storage media connected to it. When they are issued a laptop, employees SHOULD also receive an information sheet on secure handling of the device.

Secure methods SHOULD be defined for connecting laptops to internal or external data networks and the Internet. Only authorised laptops SHOULD be able to log on to the respective organisation's internal network.

The way in which data is transferred from laptops to the corresponding organisation’s information domain SHOULD be regulated. If a synchronisation tool is used, care SHOULD be taken to ensure that synchronisation conflicts can be resolved. The synchronisation process SHOULD be logged. Users SHOULD also be instructed to check the synchronisation logs.

All users SHOULD receive information as to how they can best guarantee their laptop's power supply during mobile use. Spare batteries SHOULD be stored and transported in suitable cases.

If a laptop is lost or stolen, the user SHOULD report this immediately. Organisations SHOULD have clear reporting channels for this purpose. If a lost laptop resurfaces, there SHOULD be an investigation into whether it could have been manipulated. The software used on it, including the operating system, SHOULD be completely reinstalled.

Storage media installed in laptops, such as hard disks or SSDs, SHOULD be encrypted.

All users SHOULD be advised on how to store laptops securely outside their organisation. Depending on the level of protection required for the data stored on them, laptops SHOULD also be secured against theft or kept in a locked location when not in use on the respective organisation's premises.

Before laptops are purchased, the persons in charge SHOULD carry out a requirements analysis. All possible devices SHOULD be assessed on the basis of the results. The decision on which laptops to procure SHOULD be agreed with the IT Operation Department.

A suitable regulation for the central administration of laptops SHOULD be defined. A tool for central laptop management SHOULD support all the operating systems used to the greatest extent possible.

Unused laptops SHOULD be stored in an appropriately secured room. The room used for this SHOULD meet the requirements of INF.5 Room or Cabinet for Technical Infrastructure.

The anti-theft devices to be used for laptops SHOULD be regulated. In the context of mechanical devices, care SHOULD be taken to ensure that they have a good lock.