The text of the Mobile Device Procedure
Approval #
The Chief Information Officer (CIO) approves this document. The Chief Information Security Officer (CISO) concurs on the security and privacy requirements it contains.
| Role | Name | Signature |
|---|---|---|
| Chief Information Officer (CIO) | ||
| Chief Information Security Officer (CISO), concurring |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: Every year, under the Policy and Procedure Management Policy.
Mandate. The Chief Information Officer (CIO) issues this procedure to carry out the Mobile Device Policy (POL-MOB-001) and National Institute of Standards and Technology (NIST) SP 800-53 control AC-19. It follows NIST SP 800-124 Rev. 2 for device management, NIST SP 800-163 Rev. 1 for app vetting, and 44 U.S.C. 2911 for messages kept as records. The Mobility Program Manager runs it with the Endpoint Engineering Team and the Service Desk.
1. Purpose and Scope #
Use this procedure to issue, enroll, update, and recover mobile devices, approve apps, prepare devices for international travel, keep messages as records, and review the program each year. It covers smartphones and tablets, government-furnished or personally owned. Its travel steps also cover laptops.
2. Roles #
The roles are defined in the Mobile Device Policy. In the step tables below, each step names the person who acts. The Mobility Program Manager coordinates the steps and keeps their records.
3. Definitions #
| Term | Meaning in this procedure |
|---|---|
| Mobile device | A smartphone or tablet that a person can carry, that works without a wired connection, and that stores data (NIST SP 800-53). |
| Government-furnished equipment (GFE) | A device the Organization buys and issues. |
| Personally owned device | A device the user owns and enrolls under the bring your own device (BYOD) agreement. |
| Security baseline | The device settings the Access Control Policy requires, applied and checked through the mobile device management (MDM) tool. |
| Travel configuration | The settings and minimum apps the CISO sets for devices taken to high-risk countries (NIST SP 800-53 CM-2(7)). |
| Loaner device | A GFE device kept for travel and reset after each trip. |
| Derived Personal Identity Verification (PIV) credential | A credential on the mobile device that the Organization issues based on the user’s PIV card (NIST SP 800-157). |
4. Tools and Systems of Record #
| Tool or system | Use in this procedure | Records it holds |
|---|---|---|
| The MDM tool | Enrollment, the security baseline, app catalog, compliance checks, lock and wipe | Device inventory and compliance records |
| Cloud directory conditional access | Refuses sign-ins from devices that are not enrolled or not compliant | Sign-in logs |
| The ticketing system | Device requests, travel requests, app requests, loss reports, returns | Request records |
| The security information and event management (SIEM) system | Mobile threat defense alerts and device events | Alerts and investigations |
| The asset inventory tool | GFE devices as property, with the user each is issued to | Property records |
| The document management system | This policy and procedure, the BYOD agreements, the approved app list | Approved versions and signed agreements |
5. Request and Issue a Device #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| User | 1. Request a GFE device, or ask to enroll a personally owned device, through the Service Desk. | The ticketing system | Request | AC-19 |
| Supervisor or Contracting Officer’s Representative (COR) | 2. Approve the request and state the work need. | The ticketing system | Approval | AC-19 |
| Mobility Program Manager | 3. Decide between a GFE device and BYOD, and pick an approved device model. | The ticketing system | Decision | AC-19 |
| User | 4. For BYOD, sign the BYOD agreement, which says what the Organization can see and change on the device (NIST SP 800-46 Rev. 2). | The document management system | Signed agreement | AC-19, PL-4 |
| Service Desk | 5. Record the GFE device against the user and hand it over. | The asset inventory tool | Property record | CM-8 |
Evidence: the request and approval, the signed BYOD agreement where one applies, and the property record.
6. Enroll the Device and Apply the Baseline #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Endpoint Engineering Team | 1. Enroll the device in the MDM tool. For a personally owned device, enroll only the Organization’s managed apps and data (NIST SP 800-124 Rev. 2). | The MDM tool | Enrollment record | AC-19 |
| Endpoint Engineering Team | 2. Apply the security baseline from the Access Control Policy, including encryption and mobile threat defense. | The MDM tool | Compliance record | AC-19(5), CM-6 |
| Endpoint Engineering Team | 3. Push the approved apps from the catalog. | The MDM tool | App inventory | CM-7(5) |
| Endpoint Engineering Team | 4. Issue a derived PIV credential where the user needs one (NIST SP 800-157). | The MDM tool | Issuance record | IA-2, IA-5 |
| Endpoint Engineering Team | 5. Confirm that the device shows as compliant before the user signs in. | The MDM tool | Compliance status | AC-19 |
Evidence: the enrollment record, the compliance record, the app inventory, and the derived PIV issuance record.
7. Approve a New App #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| User | 1. Request the app with its business need and the supervisor’s approval. | The ticketing system | Request | CM-7(5) |
| Endpoint Engineering Team | 2. Check that no federal rule bars the app or its maker (FAR 52.204-23; FAR 52.204-27; FAR 52.204-30). | The ticketing system | Check record | SR-6 |
| CISO | 3. Arrange a security review of the app against the Organization’s requirements (NIST SP 800-163 Rev. 1). | The ticketing system | Vetting report | SA-11 |
| Privacy Officer | 4. Complete a privacy threshold analysis when the app handles personally identifiable information (PII). | The ticketing system | Privacy threshold analysis | PT-2 |
| Agency Records Officer | 5. For a messaging app, approve its capture and retention settings (NARA Bulletin 2023-02). | The ticketing system | Records approval | AU-11 |
| CISO, and the CIO for a messaging app | 6. Approve or deny the app, and add an approved app to the list and the catalog. | The MDM tool | Approved app list | CM-7(5) |
| Endpoint Engineering Team | 7. Review each approved app every year and after each major version, and remove apps that no longer pass. | The MDM tool | Review record | CM-7(5) |
Evidence: the request, the prohibited-product check, the vetting report, the privacy threshold analysis where needed, the records approval for a messaging app, and the approved app list with its review dates.
8. Control Access and Keep Devices Updated #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Endpoint Engineering Team | 1. Set cloud directory conditional access to refuse sign-ins from devices that are not enrolled or not compliant (OMB M-22-09). | Cloud directory conditional access | Policy export | AC-19, AC-3 |
| Endpoint Engineering Team | 2. Set the minimum operating system version the CISO approves, and mark older devices not compliant. | The MDM tool | Compliance setting | SI-2 |
| User | 3. Install each operating system and app update within 30 days of release, or sooner when the Vulnerability Management Policy sets an earlier due date. | The MDM tool | Device version | SI-2 |
| Endpoint Engineering Team | 4. Review the devices past the deadline each week and contact their users. | The MDM tool | Weekly report | SI-2 |
| Mobility Program Manager | 5. Replace each device model before its maker stops sending security updates. | The asset inventory tool | Replacement plan | SA-22 |
Evidence: the conditional access policy export, the compliance settings, the weekly reports of devices past the deadline, and the replacement plan.
9. Respond to a Lost, Stolen, or Compromised Device #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| User | 1. Report the loss, theft, or signs of compromise to the Security Operations Center (SOC) and the Service Desk at once. Signs include the device acting strangely, an account lockout, or missing data. | The ticketing system | Report | IR-6 |
| Security Operations Center (SOC) | 2. Open an incident and handle it under the Incident Response Plan. | The ticketing system | Incident record | IR-4 |
| Service Desk | 3. Lock the device and remove Organization information through the MDM tool when the SOC directs. | The MDM tool | Wipe record | AC-7(2), AC-19 |
| Endpoint Engineering Team | 4. End the device’s sessions and revoke its derived PIV credential and other device credentials. | The MDM tool | Revocation record | IA-5 |
| SOC | 5. When PII may be exposed, follow the Breach Response Plan (OMB M-17-12). | The ticketing system | Breach record | IR-8 |
| Service Desk | 6. Update the device and property records, and issue a replacement where approved. | The asset inventory tool | Property record | CM-8 |
Evidence: the report and incident record, the wipe and revocation records, any breach record, and the updated property record.
10. Prepare for and Return from International Travel #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| User | 1. At least [number of days the CIO sets] before departure, submit a travel request with dates, places, devices, and the systems the user will reach. | The ticketing system | Travel request | AC-19 |
| Supervisor, and the CIO for personal travel | 2. Approve or deny the request. | The ticketing system | Approval | AC-19 |
| CISO | 3. Check the destinations against the high-risk country list and decide whether a loaner device is needed. | The ticketing system | Risk decision | CM-2(7) |
| Personnel Security Officer | 4. Brief the user before travel to a high-risk country, and receive any foreign travel report the user’s position requires. | The ticketing system | Briefing record | AT-2 |
| Endpoint Engineering Team | 5. Prepare the loaner device with the travel configuration and the fewest apps and data the trip needs, and record its baseline (NIST SP 800-53 CM-2(7)). | The MDM tool | Device baseline | CM-2(7) |
| User | 6. During the trip, keep each device in personal possession, avoid unknown networks and chargers, and report at once any time a device left the user’s sight. | The ticketing system | Report, if any | IR-6 |
| User | 7. Return the loaner device within [number of business days the CIO sets] after the trip. | The asset inventory tool | Return record | CM-8 |
| Endpoint Engineering Team | 8. Compare the device with its baseline, check for tampering, and reset it before it is used again (NIST SP 800-53 CM-2(7)). | The MDM tool | Inspection record | CM-2(7), MP-6 |
Evidence: the travel request and approval, the risk decision, the briefing record, the device baseline, the return record, and the inspection record.
11. Keep Text and Chat Messages as Records #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Agency Records Officer | 1. Keep the list of approved messaging apps with the records schedule that applies to each one (NARA Bulletin 2023-02). | The document management system | Approved list | AU-11 |
| Endpoint Engineering Team | 2. Turn on message capture for each approved messaging app, and turn off automatic deletion that the records schedule does not allow. | The MDM tool | Capture settings | AU-11 |
| User | 3. When a record is sent from a non-official account, copy an official account, or forward a complete copy to it within 20 days (44 U.S.C. 2911). | The ticketing system | Forwarded copy | AU-11 |
| Agency Records Officer | 4. Check capture for each approved app every quarter by sampling messages. Check that each sample keeps its sender, recipients, date, and attachments (36 CFR 1236.22). | The document management system | Sample results | AU-11 |
| Agency Records Officer | 5. Apply the retention in General Records Schedule (GRS) 6.1 to messages it covers, once the National Archives and Records Administration (NARA) approves the Organization’s form NA-1005. Apply the records schedule for the rest (NARA GRS 6.1). | The document management system | Retention settings | AU-11 |
Evidence: the approved messaging app list, the capture settings, the quarterly sample results, and copies forwarded from non-official accounts.
12. Recover Devices at Separation #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Supervisor or COR | 1. Open the separation request, which lists the user’s devices. | The ticketing system | Separation request | PS-4 |
| Agency Records Officer | 2. Confirm that the user’s records on the device are captured and that no legal hold applies. | The ticketing system | Records clearance | AU-11 |
| Service Desk | 3. Collect each GFE device by the user’s last day. | The asset inventory tool | Return record | PS-4 |
| Endpoint Engineering Team | 4. Remove Organization apps and data from personally owned devices, and wipe GFE devices through the MDM tool. | The MDM tool | Wipe record | AC-19 |
| Endpoint Engineering Team | 5. Sanitize each GFE device before reissue or disposal (NIST SP 800-88 Rev. 2). | The asset inventory tool | Sanitization record | MP-6 |
Evidence: the separation request, the records clearance, the return, wipe, and sanitization records.
13. Review the Program Each Year #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Mobility Program Manager | 1. Reconcile the device inventory in the MDM tool with the property records and the carrier’s list of lines, and close unused lines. | The asset inventory tool | Reconciliation | CM-8 |
| CISO | 2. Review the security baseline and the travel configuration against current NIST and the Cybersecurity and Infrastructure Security Agency (CISA) guidance. | The MDM tool | Review record | CM-2, CM-6 |
| Mobility Program Manager | 3. Review the approved app list, the BYOD agreement, and the device models. | The document management system | Review record | AC-19 |
| CIO | 4. Review the measures and approve any changes. | The document management system | Approval | PM-9 |
Evidence: the inventory reconciliation, the review records, and the CIO’s approval.
14. Recurring Schedule #
| Activity | When | Owner |
|---|---|---|
| Review devices past the update deadline | Every week | Endpoint Engineering Team |
| Report program measures | Every quarter | Mobility Program Manager |
| Sample message capture | Every quarter | Agency Records Officer |
| Review each approved app | Every year and after each major version | Endpoint Engineering Team |
| Review the program, the baseline, and the inventory | Every year | Mobility Program Manager and CISO |
| Review open exceptions | Every year | CIO |
15. Records #
The Service Desk keeps requests, approvals, and loss reports in the ticketing system. The Endpoint Engineering Team keeps enrollment, compliance, and wipe records in the MDM tool. The Mobility Program Manager keeps BYOD agreements and the approved app list in the document management system. Each record is kept under the records schedule that applies to it.
Evidence: the records listed above, retrievable for each device and each user.
16. Related Documents #
17. References #
These are the sources this document cites, with a link to each official text.
- 36 CFR Part 1236: Electronic Records Management, current text.
- Disclosure requirement for official business conducted using non-official electronic messaging accounts (44 U.S.C. § 2911).
- FAR 52.204-23: Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities, July 16, 2018.
- FAR 52.204-27: Prohibition on a ByteDance Covered Application, June 2, 2023.
- FAR 52.204-30: Federal Acquisition Supply Chain Security Act Orders — Prohibition (with FAR 52.204-29 representation and disclosures), December 4, 2023.
- NARA Bulletin 2023-02: Expanding the Use of a Role-Based Approach (Capstone) for Electronic Messages: Expanding the Use of a Role-Based Approach (Capstone) for Electronic Messages, January 5, 2023.
- NARA General Records Schedule 6.1: Email and Other Electronic Messages Managed under a Capstone Approach, January 2023.
- NIST SP 800-46 Rev. 2: Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security, July 29, 2016.
- NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
- NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization, September 2025.
- NIST SP 800-124 Rev. 2: Guidelines for Managing the Security of Mobile Devices in the Enterprise, May 2023.
- NIST SP 800-157: Guidelines for Derived Personal Identity Verification (PIV) Credentials, December 2014.
- NIST SP 800-163 Rev. 1: Vetting the Security of Mobile Applications, April 2019.
- OMB M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information, May 22, 2017.
- OMB M-22-09: Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, January 26, 2022.