ASD ISM 1533 Establish mobile device management policies

Business owner should task an IT consultant to draft a mobile device management policy.

This document should outline what types of mobile devices can be used, how they can access company data, and the security measures that must be in place. Once drafted, review the policy with key staff to ensure it is clear and practical.

IT manager should work with the HR team to ensure the mobile device policy is included in employee induction training.

This involves explaining the rules clearly and providing examples of acceptable and unacceptable use. Ensure all employees sign that they understand and will comply with the policy.

Security officer should regularly review and update the mobile device management policy.

This can be done by scheduling bi-annual reviews to incorporate new risks and technology changes, ensuring that the policy remains effective and relevant.

Office manager should implement a system to track all mobile devices accessing organisational data.

This can be accomplished by maintaining a simple inventory list using a spreadsheet, recording device type, user details, and date of last security review.

IT team should set up technical measures to enforce the policy.

This includes configuring devices to enforce password protection, remote wipe abilities, and regular updates. Utilise mobile device management software to automate these settings where possible.