SYS.3.3 Mobile Telephones

A security policy MUST be established with regard to the use and control of mobile phones. Each mobile phone user MUST be provided with a copy of the security policy. Regular checks MUST be carried out to ensure compliance with the security policy. The security policy on mobile phone use for business purposes SHOULD form part of the training provided to users on security safeguards.

If a mobile phone is lost, the SIM card used in it MUST be blocked promptly. If possible, existing anti-theft mechanisms such as remote deletion or blocking SHOULD be used. All the information necessary to block the SIM card and mobile phone MUST be immediately at hand.

Employees MUST be made aware of the particular threats posed to information security by mobile phones. They MUST be familiar with the security features of mobile phones. Users MUST know how to lock mobile phones. Users MUST be advised on how mobile phones should be stored safely and correctly.

Mobile phones MUST be reset to factory settings before disposal. A check MUST be carried out to confirm that all data has been deleted. It SHOULD also be ensured that mobile phones and any memory cards used in them are properly disposed of. If mobile phones and memory cards are collected and then disposed of at a later point in time and/or in larger quantities, they MUST be protected from unauthorised access until their disposal.

The available security mechanisms SHOULD be used and pre-configured on mobile phones. SIM cards SHOULD be protected by secure PINs. The super PIN/PUK SHOULD only be used by the people in charge within the framework of defined processes. Mobile phones SHOULD be protected by device codes. If possible, devices SHOULD be reliant on their SIM cards (SIM lock).

Regular checks SHOULD be carried out to determine whether there are any software updates for the mobile phones in use. The handling of updates SHOULD be regulated. If there are new software updates, the way in which users will be informed about them SHOULD be specified. Whether users are allowed to install updates themselves or are to hand in their mobile phones at a central location for this purpose SHOULD be specified.

Before mobile phones components are acquired, a list of requirements SHOULD be created. The list of requirements SHOULD be used to evaluate the products available on the market. A product SHOULD be selected according to whether the manufacturer will offer updates for the planned period of use. It SHOULD be ensured that spare parts such as batteries and chargers can be procured in sufficient quality.

IrDA, WLAN, Bluetooth, and other wireless interfaces of mobile phones SHOULD be disabled as long as they are not needed.

There SHOULD be rules defining the data which can be transmitted using mobile phones. The interfaces allowed for this SHOULD also be defined. A decision SHOULD also be made on how to encrypt the data as required.

The data stored on mobile phones SHOULD be backed up to another medium at regular intervals. If a defective mobile phone needs to be repaired, all its data SHOULD be deleted and the device reset to the factory settings. Replacement devices SHOULD always be available to replace a failed mobile phone on short notice.

A device pool SHOULD be set up if the users of business mobile phones change regularly. The issue and return of mobile phones and accessories SHOULD be documented. Before they are issued, it SHOULD be ensured that mobile phones are charged and equipped with the programs and data the new owner will need. In addition, users SHOULD be made aware of their obligation to comply with the relevant security policy. When devices are returned, they SHOULD be reset to factory settings.

Appropriate measures SHOULD be taken to ensure a sustainable supply of energy to mobile phones. Replaceable batteries or power banks SHOULD be used as required.

It SHOULD be clarified whether the creation of movement profiles by third parties can have a negative effect or is regarded as a problem. To prevent GPS positioning, this function SHOULD be switched off. To prevent tracking through the mobile communication network, mobile phones SHOULD be switched off and their batteries removed.

To prevent them from being associated with specific people, telephone numbers SHOULD be suppressed for outgoing calls. SMS and MMS messages SHOULD NOT be sent. Mobile phone numbers SHOULD NOT be published or passed on to unauthorised third parties.

To ensure that confidential information cannot be subject to eavesdropping, mobile phones SHOULD NOT be taken into rooms used for confidential meetings and conversations. If necessary, this mobile phone ban SHOULD be enforced by detectors.