Mobile Devices Policy

Mobile Devices Policy

Document Name: Mobile Devices Policy
Version: 1.0
Approved by: Directors, Immercial Limited
Review Frequency: Annual or upon material change

Purpose

Immercial Limited applies proportionate security controls to laptops, smartphones, tablets and other portable devices used to access Immercial systems, information or services.

Requirements

Devices used for Immercial business must:

• be authorised for business use;
• use password, PIN, biometric or equivalent access protection;
• use automatic screen locking;
• use MFA for supported business accounts and services;
• use supported operating systems and receive security updates promptly or automatically;
• use device encryption where supported;
• be protected against unauthorised access, loss and theft;
• access business information only through approved accounts, applications and cloud services;
• not store business information unnecessarily outside approved Immercial systems;
• not be rooted, jailbroken or otherwise modified in a way that weakens security controls;
• use appropriate care when connected to public or shared networks;
• be kept physically secure when travelling or working away from the normal work environment.

Confidential, client, personal and Restricted information must be handled in accordance with Immercial’s Information Classification, Labelling & Handling Policy and Access Control Policy.

Loss, Theft or Compromise

Loss, theft, suspected compromise or unauthorised access involving a mobile device used for Immercial business must be reported promptly to a Director.

Affected accounts, sessions or credentials must be disabled or changed where appropriate and the matter managed under the Information Security Incident Procedure.

Remote locking or wiping should be used where available and appropriate.

Personal Devices

Where a personally owned device is authorised for Immercial business, it must meet the same relevant security requirements as a business-owned device.

Business information should remain within approved Immercial applications and cloud services and must be removed when business access is no longer required.

Responsibility and Review

The Directors approve and oversee this policy.

The policy is communicated to relevant personnel and interested parties where applicable and reviewed annually and following significant changes to devices, systems, risks or working arrangements.