NIST Releases Revised Guidelines for Managing Mobile Device Security | Practical Law

NIST Releases Revised Guidelines for Managing Mobile Device Security | Practical Law

The National Institute of Standards and Technology (NIST) has published Guidelines for Managing the Security of Mobile Devices in the Enterprise for federal agencies to secure methods for workers using smart phones and tablets.

NIST Releases Revised Guidelines for Managing Mobile Device Security

Practical Law Legal Update 7-532-5104 (Approx. 3 pages)

NIST Releases Revised Guidelines for Managing Mobile Device Security

by PLC Intellectual Property & Technology
Published on 26 Jun 2013 • USA (National/Federal)
The National Institute of Standards and Technology (NIST) has published Guidelines for Managing the Security of Mobile Devices in the Enterprise for federal agencies to secure methods for workers using smart phones and tablets.
The National Institute of Standards and Technology (NIST) published Guidelines for Managing the Security of Mobile Devices in the Enterprise on June 25, 2103 to help federal agencies centrally manage the security of smart phones and tablets. The guidelines extensively update and replace the NIST's 2008 Guidelines on Cell Phone and PDA Security and reflect comments received on a 2012 draft.
The guidelines, which address securing both organization-provided and personally-owned mobile devices, provide:
  • Recommendations for selecting, implementing and using centralized management technologies.
  • An overview of mobile devices, including the security concerns posed by mobile device use.
  • Recommendations for securing mobile devices throughout their life cycles.
The guidelines also urge organizations to:
  • Adopt a mobile device security policy.
  • Evaluate which security services are necessary for their environment, and design or acquire solutions that provide them.
  • Develop system threat models for mobile devices and the resources accessible through mobile devices.
  • Test a prototype of their mobile device solution before putting it into production.
  • Secure organization-issued devices before allowing users to access them.
  • Regularly maintain mobile device security.