Mobile Device Policy

Approval #

The Chief Information Officer (CIO) approves this document. The Chief Information Security Officer (CISO) concurs on the security and privacy requirements it contains.

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

Mandate. National Institute of Standards and Technology (NIST) SP 800-53 control AC-19 requires the Organization to set configuration requirements, connection requirements, and use rules for the mobile devices it controls. The rules apply when those devices leave the Organization’s buildings too. AC-19 also requires the Organization to authorize each device before it connects. NIST SP 800-124 Rev. 2 gives the federal guidance for managing mobile devices. Office of Management and Budget (OMB) M-22-09 requires a complete inventory of devices and asks agencies to use a device-level signal in each access decision. Federal law makes text and chat messages about Organization business federal records (44 U.S.C. 2911).

The Chief Information Officer (CIO) owns this policy. The security rules for mobile devices stay in the Access Control Policy (POL-AC). The CIO sets the program rules in this policy: who gets a device, how it is enrolled and used, and what happens when it is lost, taken abroad, or returned. The steps are in the Mobile Device Procedure (PROC-MOB-001).

1. Policy Statement #

The Organization issues mobile devices to people whose work needs them and may allow approved personally owned devices. A device reaches Organization information only after the Endpoint Engineering Team enrolls it in the mobile device management (MDM) tool and it meets the security baseline. Users use only approved apps, keep their devices updated, keep work messages as records, and report a lost or stolen device at once. International travel with a device needs approval before the trip.

2. Scope #

This policy applies to all employees, contractors, interns, detailees, and other people who use a mobile device to reach Organization information. A mobile device is a smartphone or tablet. The policy covers:

• Government-furnished equipment (GFE): devices the Organization buys and issues.
• Personally owned devices that a user enrolls under the bring your own device (BYOD) rules in this policy.
• The mobile services that let a device reach Organization email, files, and systems.

Laptops follow the Configuration Management Policy (POL-CM). The international travel rules in this policy also apply to laptops. This policy does not apply to classified devices or national security systems.

3. Requirements #

3.1 Who may get a device #

1. A supervisor must approve each request for a GFE device and state the work need (NIST SP 800-53 AC-19). For a contractor, the Contracting Officer’s Representative (COR) approves.
2. The Mobility Program Manager must issue devices by work need and must offer the BYOD option where it meets the need (NIST SP 800-53 AC-19).
3. Users must return a GFE device when their duties no longer need it, when they separate, or when the Mobility Program Manager asks (NIST SP 800-53 PS-4).
4. The Mobility Program Manager may refuse a replacement to a user who has lost devices more than once, after review with the user’s supervisor.

3.2 Enrolling devices and meeting the baseline #

1. Users must not connect a device to Organization systems or information until it is enrolled in the MDM tool and meets the security baseline in the Access Control Policy (NIST SP 800-53 AC-19).
2. The Endpoint Engineering Team must keep every enrolled device in the device inventory, with its owner, model, operating system version, and status (OMB M-22-09).
3. The Mobility Program Manager must buy device models chosen for their security features and update support. Where possible, the model and its operating system appear on the National Information Assurance Partnership (NIAP) list of products evaluated against the mobile device protection profile (NIST SP 800-124 Rev. 2).
4. Contracting Officers must not buy devices or mobile services that use covered telecommunications equipment or services, or products a federal exclusion or removal order names (FAR 52.204-25; FAR 52.204-30).
5. When the MDM tool runs as a cloud service, the Mobility Program Manager must confirm that it holds a FedRAMP authorization at the right impact level before the Organization uses it (OMB M-24-15).

3.3 Using a personally owned device #

1. A user may enroll a personally owned device only after signing the BYOD agreement. The agreement states what the Organization can see and change on the device, and what it cannot (NIST SP 800-46 Rev. 2).
2. The Endpoint Engineering Team must manage Organization apps and data on a personally owned device apart from the user’s own apps and data. The team may remove only Organization apps and data from that device (NIST SP 800-124 Rev. 2).
3. The user pays for the device and its service, including roaming charges, unless an agreement says otherwise. The BYOD agreement states this.
4. The user must not move Organization information from a managed app into a personal app, such as by copy, screen capture, or personal backup (NIST SP 800-124 Rev. 2).
5. The user must make Organization information on the device available when the Office of the General Counsel (OGC) needs it for an incident, a records request, or a legal hold (NARA Bulletin 2015-02).

3.4 Using approved apps only #

1. Users must handle Organization information only in apps on the approved mobile app list. Users must install apps only from the official store or the Organization’s app catalog in the MDM tool (NIST SP 800-53 CM-11).
2. The CISO must approve an app for the list only after a security review under NIST SP 800-163 Rev. 1. An app that handles personally identifiable information (PII) also needs a privacy threshold analysis.
3. Users must not install, and the Endpoint Engineering Team must remove, any app that ByteDance develops, provides, or controls (No TikTok on Government Devices Act; FAR 52.204-27). OMB M-26-17 withdrew the earlier OMB guidance after the Department of Justice found that the TikTok app run by the TikTok U.S. Data Security Joint Venture is not covered (OMB M-26-17). The CIO may still bar that app for the Organization’s own reasons.
4. The Endpoint Engineering Team must remove any Kaspersky product, and any product a federal exclusion or removal order names (FAR 52.204-23; FAR 52.204-30).

3.5 Signing in from a device #

1. Access to Organization resources must depend on the device’s enrollment and compliance state as well as the user’s identity (OMB M-22-09).
2. Users must sign in with phishing-resistant multi-factor authentication (OMB M-22-09). Where a user needs a Personal Identity Verification (PIV) credential on a device, the Organization issues a derived PIV credential (NIST SP 800-157; FIPS 201-3).
3. Users must not use text messages or voice calls as a sign-in factor for Organization accounts (CISA Mobile Communications Best Practice Guidance).

3.6 Keeping devices updated #

1. Users must install each operating system and app update within 30 days of its release, or by the earlier due date the Vulnerability Management Policy (POL-VM-001) sets (NIST SP 800-53 SI-2; CISA BOD 26-04).
2. The Endpoint Engineering Team must block access from a device that runs an operating system version below the minimum the CISO sets (NIST SP 800-124 Rev. 2).
3. The Mobility Program Manager must replace a device model before its maker stops sending security updates (NIST SP 800-53 SA-22).

3.7 Keeping messages as records #

1. Text, chat, and instant messages about Organization business are likely federal records (NARA Bulletin 2023-02). Users must send them only through messaging apps that the CIO approved and whose messages the Organization captures.
2. A user who creates or sends a record from a non-official messaging account must copy an official account on it. Otherwise, the user must forward a complete copy to an official account within 20 days (44 U.S.C. 2911). A supervisor may take disciplinary action for an intentional violation (44 U.S.C. 2911).
3. The Agency Records Officer must approve each messaging app’s capture and retention settings before the CIO approves the app. No app may delete messages automatically before the records schedule allows (NARA Bulletin 2023-02; 36 CFR Part 1222).
4. Users who are highly targeted, such as senior officials, must use end-to-end encrypted messaging apps that the CIO approved for that purpose (CISA Mobile Communications Best Practice Guidance).
5. The Agency Records Officer may apply General Records Schedule (GRS) 6.1 to email and to text and chat messages from mobile devices. The Officer may do so only after the National Archives and Records Administration (NARA) approves the Organization’s form NA-1005 (NARA GRS 6.1). NARA’s 2026 draft revision of that schedule is not approved for use.
6. The Agency Records Officer must make sure each email record keeps the names of the sender and all addressees, the date sent, and its attachments (36 CFR 1236.22). The Officer applies the same rule to records from approved messaging apps.

3.8 Reporting lost, stolen, or compromised devices #

1. Users must report a lost, stolen, or possibly compromised device to the Security Operations Center (SOC) and the Service Desk at once (NIST SP 800-53 IR-6).
2. The SOC must handle each report as a possible incident under the Incident Response Plan (PLAN-IR-001). When PII may be exposed, the SOC also follows the Breach Response Plan (PLAN-BR-001) (OMB M-17-12).
3. The Service Desk must lock the device and remove Organization information from it through the MDM tool when the SOC directs (NIST SP 800-124 Rev. 2).

3.9 Traveling abroad with a device #

1. Users must get approval before taking any GFE device, or using any device to reach Organization information, outside the United States and its territories. Users must ask at least [number of days the CIO sets] before departure (NIST SP 800-53 AC-19).
2. For official travel, the supervisor approves. For personal travel, the supervisor confirms the user must stay reachable, and the CIO approves (NIST SP 800-53 AC-19).
3. For a country on the high-risk list the CISO keeps, users must take a loaner device with the travel configuration instead of their usual device (NIST SP 800-53 CM-2(7)).
4. Users must keep devices in their possession during travel and must report any time a device left their sight, such as at a border inspection (NIST SP 800-53 CM-2(7)).
5. Users must return each loaner device within [number of business days the CIO sets] after the trip. The Endpoint Engineering Team must check it for tampering and reset it before anyone uses it again (NIST SP 800-53 CM-2(7)).

3.10 Returning devices at separation #

1. Users must return each GFE device by their last day (NIST SP 800-53 PS-4). Supervisors and CORs confirm the return.
2. Before the Endpoint Engineering Team wipes a device, the Agency Records Officer must confirm that its records are captured and that no legal hold applies (NARA Bulletin 2023-02).
3. The Endpoint Engineering Team must remove Organization apps and data from a personally owned device on the user’s last day (NIST SP 800-124 Rev. 2).
4. The Endpoint Engineering Team must sanitize each GFE device before it is reissued or disposed of (NIST SP 800-88 Rev. 2; NIST SP 800-53 MP-6).

3.11 Acceptable use #

1. Users must use GFE devices for official business. Limited personal use is allowed only as the General User Rules of Behavior (ROB-GEN-001) allow (5 CFR 2635.704).
2. Users have no expectation of privacy in their use of GFE devices or Organization mobile services (NIST SP 800-53 AC-8).
3. Users must not remove the MDM tool from a device, jailbreak or root it, or turn off its security settings. Users must not sync Organization information to a service the CIO has not approved (NIST SP 800-53 AC-19).
4. Users must not store or send classified information on a mobile device. Users must not take a device into an area that processes classified information unless that area’s rules allow it (NIST SP 800-53 AC-19(4)).

4. Roles and Responsibilities #

5. How Exceptions Are Approved #

A user or System Owner asks for an exception through the Service Desk, with the reason, the risk, and an end date. The Mobility Program Manager and the CISO review the request. The CIO decides it. An exception to a security rule in the Access Control Policy also needs the Authorizing Official’s acceptance of the risk. The Mobility Program Manager records each exception and reviews it at least every year. No exception may allow a prohibited app or product under Federal Acquisition Regulation (FAR) 52.204-23, 52.204-25, 52.204-27, or 52.204-30.

6. How the CIO Measures the Program #

Each quarter, the Mobility Program Manager reports these measures to the CIO and the CISO:

• Devices that reach Organization information without enrollment (the target is zero).
• The share of enrolled devices that meet the baseline.
• The share of devices on the latest operating system update, and devices past the update deadline.
• Apps on the approved list that are past their yearly review.
• Lost and stolen devices, and the time from report to wipe.
• Loaner devices returned late or not inspected.
• GFE devices not returned at separation.

7. Where the Related Rules Are #

8. References #

These are the sources this document cites, with a link to each official text.

• 5 CFR Part 2635: Standards of Ethical Conduct for Employees of the Executive Branch, current text.
• 36 CFR Part 1222: Creation and Maintenance of Federal Records, current text.
• 36 CFR Part 1236: Electronic Records Management, current text.
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk, June 10, 2026.
• Disclosure requirement for official business conducted using non-official electronic messaging accounts (44 U.S.C. § 2911).
• FAR 52.204-23: Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities, July 16, 2018.
• FAR 52.204-25: Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (Section 889; with FAR 52.204-24 and 52.204-26 representations), August 13, 2020.
• FAR 52.204-27: Prohibition on a ByteDance Covered Application, June 2, 2023.
• FAR 52.204-30: Federal Acquisition Supply Chain Security Act Orders — Prohibition (with FAR 52.204-29 representation and disclosures), December 4, 2023.
• FIPS 201-3: Personal Identity Verification (PIV) of Federal Employees and Contractors, January 2022.
• Mobile Communications Best Practice Guidance, December 18, 2024.
• NARA Bulletin 2015-02: Guidance on Managing Electronic Messages: Guidance on Managing Electronic Messages, July 29, 2015.
• NARA Bulletin 2023-02: Expanding the Use of a Role-Based Approach (Capstone) for Electronic Messages: Expanding the Use of a Role-Based Approach (Capstone) for Electronic Messages, January 5, 2023.
• NARA General Records Schedule 6.1: Email and Other Electronic Messages Managed under a Capstone Approach, January 2023.
• NIST SP 800-46 Rev. 2: Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security, July 29, 2016.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization, September 2025.
• NIST SP 800-124 Rev. 2: Guidelines for Managing the Security of Mobile Devices in the Enterprise, May 2023.
• NIST SP 800-157: Guidelines for Derived Personal Identity Verification (PIV) Credentials, December 2014.
• NIST SP 800-163 Rev. 1: Vetting the Security of Mobile Applications, April 2019.
• No TikTok on Government Devices Act (Pub. L. 117-328, div. R, § 102), December 29, 2022.
• OMB M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information, May 22, 2017.
• OMB M-22-09: Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, January 26, 2022.
• OMB M-24-15: Modernizing the Federal Risk and Authorization Management Program (FedRAMP), July 25, 2024.
• OMB M-26-17: Rescission of M-23-13, August 10, 2026.