SYS.3.2.1 General Smartphones and Tablets

Before smartphones or tablets are provided, operated, or used by an organisation, a general policy for the use and control of such devices MUST be defined. In so doing, it MUST, amongst other things, be specified who may access which information within the organisation using smartphones.

An organisation MUST define a general policy for cloud use and the protection and control of information in relation to smartphones and tablets. The permitted use of cloud services in connection with the organisation's information MUST be clarified and defined. Whether and to what extent cloud services are allowed for private use of devices MUST be determined. Users MUST be regularly made aware of the issues regarding the use of such cloud services.

All mobile devices MUST be configured to meet the required level of protection. To this end, an appropriate basic configuration of security mechanisms and settings MUST be established and documented. Functions that are not required SHOULD be disabled. The activation of communication interfaces MUST be regulated and reduced to the minimum required for work-related purposes. Unused interfaces SHOULD be disabled.

Smartphones and tablets MUST be protected with an appropriately complex device lock code. Screen locking MUST be used. The display of confidential information on lock screens MUST be disabled. All mobile devices MUST automatically activate their screen lock after a reasonably short period of time. This time period MUST be related to the required level of protection.

After each failed attempt to unlock a device, the user SHOULD be required to wait longer before trying again. The number of device lock codes after which a code may be repeated SHOULD be specified. After several failed attempts to unlock a mobile device's screen, the device SHOULD perform a factory reset. The data or encryption keys at hand SHOULD be deleted securely in this process. When changing their passwords, users SHOULD avoid choosing a new password that they have used recently.

When selecting mobile devices to be procured, an organisation MUST ensure that the manufacturer specifies the period of time for which it plans to provide security updates for the devices. Older devices that are no longer provided with updates MUST be disposed of and replaced with devices supported by the respective manufacturer. In addition, apps SHOULD NOT be used if they are no longer supported by the manufacturer.

App and operating system access to data and interfaces MUST be restricted appropriately. The related data protection settings MUST be configured as restrictively as possible. In particular, access to camera, microphone, location, and health/fitness data MUST be checked for compliance with an organisation's internal data protection and security requirements. This access MUST be configured restrictively or disabled.

Security-relevant authorisation settings MUST be set so that they cannot be changed by users or apps. If this is not technically possible, the authorisation settings MUST be regularly checked and reset. In particular, this MUST be done after updates are installed.

If devices are lost or unauthorised changes to devices and their software are detected, the respective users MUST immediately inform the persons in charge.

An organisation MUST regulate whether, how, and which apps users are allowed to install themselves on their devices. Users SHOULD only be allowed to install approved apps. An organisation MUST define the sources from which apps may be installed. The installation of apps from unapproved sources MUST be prevented.

Functional extensions SHOULD only be used restrictively. If possible, functional extensions SHOULD not be used at all. Functional extensions SHOULD NOT have any automatic access to sensitive information. They SHOULD NOT be able to circumvent or change the specified basic configurations.

A binding policy for employees SHOULD be established for the use of mobile devices. This policy SHOULD define how mobile devices are to be used and maintained. It SHOULD address the issues of secure storage and loss reporting. It SHOULD also prohibit users from uninstalling management software, rooting their devices, or changing security-related configurations.

The non-volatile storage of mobile devices SHOULD be encrypted. Sensitive data on additional storage media in use (such as SD cards) SHOULD be encrypted.

Device names SHOULD not include any information regarding the respective users or organisation.

A decision SHOULD be taken on whether and how functions should be used to transmit screen content and audio or video content (screen sharing or casting). These functions SHOULD be regulated in organisational or technical terms. To this end, a corresponding agreement SHOULD be established with users.

Communication interfaces SHOULD only be activated when needed and in suitable environments. If an MDM system is used, the interfaces SHOULD be managed centrally via this system.

If a biometric procedure is used for authentication (e.g. based on a fingerprint sensor), it SHOULD be checked whether similarly high or higher protection can be achieved compared to using a device password. If this is unclear or if the level of protection is actually lower, the biometric procedure SHOULD NOT be used. Users SHOULD be made aware that biometric features can be falsified.

Voice assistants SHOULD only be used when they are necessary. Otherwise, they SHOULD be disabled. In general, it SHOULD not be possible to use a voice assistant when a device is locked.

Mobile end devices SHOULD only be integrated into an organisation's infrastructure through a VPN. An appropriate method SHOULD be selected and used for this purpose. Instead of passwords, devices SHOULD authenticate themselves to internal infrastructure via certificates.

If an organisation already uses a reputation service or a corresponding proxy server, this SHOULD be stored as a global HTTP proxy for all the installed browsers in use. If such a proxy is only accessible within the internal network in question, end devices SHOULD be integrated (either permanently or based on the apps used) using a VPN connection.

If mobile devices are not integrated into an organisation's existing proxy or reputation infrastructure, filtering options based on whitelists or blacklists or third-party content filters SHOULD be used for web browsers.

Whether mobile payments are allowed with work-related smartphones and tablets SHOULD be regulated.

Smartphones and tablets SHOULD be managed by an MDM system.

All mobile end devices SHOULD be protected against malware. Appropriate security apps SHOULD be selected for end devices if possible. The security apps SHOULD be installed automatically—for example, via an MDM system.

Default gateway entries, such as the DNS servers of the manufacturer or developer in question, SHOULD be replaced by those of the provider or the organisation at hand.

If the provider offers DNS-over-HTTPS (DoH), this SHOULD be used. If this is not yet offered, it SHOULD be disabled.

If employees are permitted to use work-related devices privately as well, solutions for isolated working environments SHOULD be used on these end devices. If possible, only certified products (e.g. those in accordance with Common Criteria) SHOULD be purchased for this purpose. The organisation's data SHOULD remain in the organisation's environment.

Information on mobile devices SHOULD be encapsulated (e.g. in a PIM container). In addition, this data SHOULD be secured by separate authentication and a form of data and transport encryption that is independent from the operating system in use.

Depending on the protection needs at hand, organisations SHOULD use specially secured mobile devices that are certified for processing information in line with statutory information protection classifications.

It SHOULD be checked whether an organisation-related access point to mobile networks (an access point name, APN) can be used to limit the pool of permitted devices. The mobile service provider in question SHOULD assign an IP address range coordinated with the respective organisation to all the devices that use this APN. For authentication, a complex password with a maximum of 64 characters SHOULD be agreed with the mobile service provider. When using an organisation-related APN, authentication SHOULD take place on the basis of the CHAP protocol.

In case of increased protection needs, the users of mobile end devices SHOULD only be able to install approved and tested apps. If an MDM system is used, it SHOULD prevent other apps from being installed; alternatively, it SHOULD immediately remove apps that are installed without authorisation.

A firewall SHOULD be installed and activated on smartphones and tablets.