Information on mobile devices is not accessed from public or insecure locations.

]]> This section covers information on accessing information using agency-owned mobile devices from unsecured locations outside the office and home environments.  This section does not apply to working from home; requirements relating to home-based work are outlined in Section 21.3 – Working From Home.  Further information on the use of mobile devices can be found in Section 21.1 – Agency Owned Mobile Devices.

]]> Also refer to Chapter 12 - Product Security for requirements on product security, selection, maintenance, sanitisation and disposal.

]]> As the security risk relating to specific targeting of mobile devices capable of processing highly classified information is high, these mobile devices cannot be used outside of facilities certified to an appropriate level to allow for their use.  In addition, as agencies have no control over public locations including, but not limited to, such locations as public transport, transit lounges, hotel lobbies, and coffee shops, mobile devices are not approved to process classified information as the security risk of classified information being overheard or observed is considered to be too high in such locations.

]]> Agencies MUST NOT allow personnel to access or communicate classified information on mobile devices outside of secure areas unless there is a reduced chance of being overheard and having the screen of the device observed.

]]> Agencies allowing personnel to access or communicate classified information outside of the office SHOULD NOT allow personnel to do so in public locations (e.g. public transport, transit lounges, hotel lobbies and coffee shops).

]]> Mobile devices used outside the office are frequently transferred through areas not certified to process the classified information on the device.  Mechanisms need to be put in place to protect the information stored on those devices.

]]> When agencies apply encryption to mobile devices to reduce their physical transfer requirements it is only effective when the encryption function of the device is not authenticated.  In most cases this will mean the mobile device will be in an unpowered state (i.e.  not turned on), however, some devices are capable of deauthenticating the cryptography when it enters a locked state after a predefined timeout period.  Such mobile devices can be carried in a locked state in accordance with reduced physical transfer requirements based on the assurance given in the cryptographic functions.

]]> Agencies MUST ensure mobile devices are carried in a secured state when not being actively used, by:

• power off; or
• power on but pass code enabled.

]]> Mobile devices are portable in nature and can be easily stolen or misplaced.  It is strongly advised that personnel do not leave mobile devices unattended at any time.

]]> When in use mobile devices MUST be kept under continual direct supervision.

]]> If personnel place mobile devices or media in checked-in luggage when travelling they lose control over the devices.  Such situations provide an opportunity for mobile devices to be stolen or tampered with by an attacker.

]]> When travelling with mobile devices and media, personnel MUST retain control over them at all times including by not placing them in checked-in luggage or leaving them unattended.

]]> Travelling personnel requested to decrypt mobile devices for inspection or from whom mobile devices are taken out of sight by border control MUST report the potential compromise of classified information or the device to an ITSM as soon as possible.

]]>