<section title="22.3. Working From Home"><subsection title="Objective"><paragraph
    title="22.3.1."


><![CDATA[<p>Personnel&nbsp;working from home protect classified information in the same manner as in the office environment.</p>]]></paragraph>
 </subsection>
<subsection title="Context"> <block title="Scope"><paragraph
    title="22.3.2."


><![CDATA[<p>This section covers accessing official information and agency information using mobile devices from a home environment in order to conduct home-based work. &nbsp;Further information on the use of mobile devices can be found in <a href="http://nzism.gcsb.govt.nz/ism-document#Section-17004">Section 21.1 – Agency Owned Mobile Devices</a>.</p>]]></paragraph>
</block>
<block title="The use of workstations instead of mobile devices"><paragraph
    title="22.3.3."


><![CDATA[<p>Where an agency chooses to issue a workstation for home-based work instead of a mobile device, the requirements for mobile devices within <a href="http://nzism.gcsb.govt.nz/ism-document#Section-17004">Section 21.1 – Agency Owned Mobile Devices</a>, equally apply to the workstation that is used.</p>]]></paragraph>
<paragraph
    title="22.3.4."


><![CDATA[<p>It is important to note that product security, selection, maintenance, sanitisation and disposal requirements in&nbsp;<a title="Product Security" href="http://nzism.gcsb.govt.nz/ism-document#Chapter-14397">Chapter 12 - Product Security</a>&nbsp;apply to <strong>all</strong> agency-owned mobile devices.</p>]]></paragraph>
</block>
</subsection>
<subsection title="Rationale &amp; Controls"> <block title="Storage requirements"><paragraph
    title="22.3.5.R.01."

    tags="Governance,Mobile Devices"


><![CDATA[<p>All mobile devices have the potential to store classified information and therefore need protection against loss and compromise.</p>]]></paragraph>
<paragraph
    title="22.3.5.R.02."

    tags="Governance,Mobile Devices"


><![CDATA[<p>Refer to the&nbsp;<a title="PSR - Mobile and Remote working" rel="noopener noreferrer" href="https://protectivesecurity.govt.nz/information-security/managing-specific-scenarios/mobile-and-remote-working/" target="_blank">PSR - Mobile and Remote working</a></p>
<p>Refer to the&nbsp;<a title="Handling requirements for protectively marked information and equipment" rel="noopener noreferrer" href="https://protectivesecurity.govt.nz/information-security/classification-system-and-handling-requirements/handling-requirements/" target="_blank">PSR&nbsp;- Handling Requirements for protectively marked information and equipment</a></p>]]></paragraph>
<paragraph
    title="22.3.5.C.01."

    tags="Governance,Mobile Devices"


    classification="All Classifications"
    compliance="Must"
    cid="4571"
><![CDATA[<p>Agencies MUST ensure that when mobile devices are not being actively used they are secured in accordance with the minimum physical security requirements as stated in the <a title="Protective Security Requirements - Physical Security" rel="noopener noreferrer" href="https://protectivesecurity.govt.nz/physical-security/" target="_blank">PSR</a>.</p>]]></paragraph>
</block>
<block title="Processing requirements"><paragraph
    title="22.3.6.R.01."

    tags="Governance,Mobile Devices"


><![CDATA[<p>When agencies consider allowing personnel to work from a home environment they need to be aware that implementing physical security measures may require modifications to the person’s home, or the provision of approved containers or secure storage units at the expense of the agency.</p>]]></paragraph>
<paragraph
    title="22.3.6.R.02."

    tags="Governance,Mobile Devices"


><![CDATA[<p>Refer to the&nbsp;<a title="PSR - Mobile and Remote working" rel="noopener noreferrer" href="https://protectivesecurity.govt.nz/information-security/managing-specific-scenarios/mobile-and-remote-working/" target="_blank">PSR - Mobile and Remote working</a></p><p>Refer to the&nbsp;<a title="Handling requirements for protectively marked information and equipment" rel="noopener noreferrer" href="https://protectivesecurity.govt.nz/information-security/classification-system-and-handling-requirements/handling-requirements/" target="_blank">PSR&nbsp;- Handling Requirements for protectively marked information and equipment</a></p>]]></paragraph>
<paragraph
    title="22.3.6.C.01."

    tags="Governance,Mobile Devices,Physical Security"


    classification="All Classifications"
    compliance="Must"
    cid="4575"
><![CDATA[<p>Agencies MUST ensure that the area within which mobile devices are used meets the minimum physical security requirements as stated in the <a title="Protective Security Requirements - Physical Security" rel="noopener noreferrer" href="https://www.protectivesecurity.govt.nz/physical-security/" target="_blank">PSR</a>.</p>]]></paragraph>
</block>
</subsection>
</section>
