AC-19 Access Control for Mobile Devices
Last Review: 10/1/22
Statement
WTAMU shall establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, whether owned by the state organization or the employee.
Applicability
This Control applies to all West Texas A&M own mobile devices. The intended audience for this Control includes all information resource owners, custodians, and users of information resources.
Implementation
- Mobile devices, including those personally owned used to access University resources (ie email) shall require a password or other means of authentication be enabled on the lock screen.
- Connection of mobile devices to WTAMU’s physical network must be authorized by the University. IT must monitor for unauthorized connections of mobile devices.
- Mobile devices storing sensitive or confidential information shall be encrypted using a University approved encryption technique.
- Sensitive or confidential information transmission shall not be transmitted over a wireless connection without the use of an encrypted connection or VPN.
- Unattended mobile devices shall be kept physically secure using means appropriately commensurate with associated risk.
- Mobile devices used to access University data shall be kept up-to-date/patched, have anti-virus software, and if appropriate have a personal firewall enabled.
- IT shall manage mobile devices owned by the University using a centralized Mobile Device management system (MDM). The MDM shall allow IT to block or uninstall applications that pose a security risk to the University or are deemed inappropriate.