Purpose
This policy establishes the security requirements for mobile devices and personal devices used to access Carriyo systems and data. It defines the controls required to protect Carriyo's information assets when accessed from mobile phones, tablets, and personal laptops, whether company-provided or personally owned (BYOD). This policy supports ISO 27001:2022 Annex A control A.8.1 (User endpoint devices).
Implementation status: Carriyo does not yet operate a device management (MDM) platform; one is to be assessed and purchased together with an endpoint protection (EDR) product. The device-management requirements in this policy state the target control; until deployment is evidenced in CAR-ISMS-LST-001, device compliance is verified manually and Annex A control A.8.1 is recorded as Partial in the Statement of Applicability (CAR-ISMS-REC-002).
Scope
This policy applies to:
- Company-provided mobile devices — Smartphones and tablets issued by Carriyo to employees or contractors
- BYOD devices — Personally owned smartphones, tablets, and laptops used to access Carriyo systems, data, or services (including email, messaging, cloud applications, and code repositories)
- All personnel — Employees, contractors, and third-party service providers who access Carriyo systems from mobile or personal devices
This policy complements the Remote Working Policy (CAR-ISMS-POL-016). Where both policies apply, the more restrictive requirement takes precedence.
Device Classification
Company-Provided Mobile Devices
Devices purchased and owned by Carriyo, issued to personnel for business use. Carriyo has full management authority over these devices.
BYOD — Managed Access
Personally owned devices where the owner has consented to Carriyo's mobile application management (MAM) controls being applied to the work profile or work applications. Carriyo manages the work data and applications but does not manage the entire device.
BYOD — Limited Access
Personally owned devices that are used only to access web-based Carriyo services (email via browser, cloud applications) without installation of Carriyo-managed applications. Access is restricted to services that do not require data to be stored locally on the device.
Enrolment Requirements
Company-Provided Devices
All company-provided mobile devices must be enrolled in Carriyo's device management system before being issued to personnel. Enrolment includes:
- Registration of the device serial number, make, model, and assigned user
- Application of the Carriyo device security profile (see Minimum Security Configurations below)
- Installation of required security applications (endpoint protection, approved authenticator app)
- Configuration of remote wipe capability
- Acceptance of the device use agreement by the assigned user
BYOD Enrolment
Personnel who wish to use personal devices to access Carriyo systems must complete the following enrolment process:
- Request — Submit a BYOD access request to the IT Administrator, specifying the device type, operating system version, and intended use.
- Eligibility check — The device must meet the minimum requirements defined in this policy. Devices that cannot meet the requirements are not approved.
- Consent — The device owner signs a BYOD agreement acknowledging:
- Carriyo's right to manage work data and applications on the device
- Carriyo's right to remotely wipe work data (not personal data, under MAM) if the device is lost, stolen, or the individual's relationship with Carriyo ends
- The owner's responsibility to maintain the device's operating system and security updates
- The owner's agreement to report lost, stolen, or compromised devices immediately
- Configuration — The IT Administrator or the user (with guidance) installs the required work profile or MAM agent and configures the device according to this policy.
- Registration — The device is registered in the device inventory with the owner's name, device details, and enrolment date.
Minimum Security Configurations
All Mobile Devices (Company and BYOD)
| Control | Requirement |
|---|---|
| Operating system | Current vendor-supported version; devices running unsupported OS versions are not permitted to access Carriyo systems |
| OS updates | Applied within 14 days of release for non-critical updates; within 7 days for security patches |
| Screen lock | Enabled with a minimum 6-digit PIN, pattern, or biometric authentication |
| Auto-lock timeout | Maximum 2 minutes of inactivity |
| Encryption | Full device encryption enabled (enabled by default on modern iOS and Android devices) |
| Biometric authentication | Permitted as a convenience method but must not be the sole authentication method for accessing Restricted data |
| Jailbreaking / rooting | Strictly prohibited; jailbroken or rooted devices are blocked from accessing Carriyo systems |
| App installation sources | Company devices: only from approved app stores and Carriyo-managed distribution; BYOD: work applications only from approved sources |
Additional Requirements for Company-Provided Devices
| Control | Requirement |
|---|---|
| Device management | Enrolled in Carriyo's device management (MDM) platform with full device management profile — enrolment becomes mandatory once the platform is deployed (planned) |
| Remote wipe | Full device remote wipe capability enabled |
| App restrictions | Installation of applications restricted to approved app catalogue and standard app stores |
| VPN | Not applicable today — no corporate VPN exists. Once the planned VPN is in place, configured for connection when accessing the critical systems behind it |
| Camera/microphone restrictions | May be restricted in specific contexts as determined by security requirements |
Additional Requirements for BYOD (Managed Access)
| Control | Requirement |
|---|---|
| Work profile / container | Work data and applications are isolated in a managed work profile or container (e.g., Android Work Profile, iOS managed apps) |
| MAM controls | Mobile Application Management applied to work applications; controls include data loss prevention (prevent copy/paste from work to personal apps, prevent saving work files to personal storage) |
| Remote wipe scope | Remote wipe limited to the work profile / managed applications and data; personal data is not affected |
| Minimum OS version | Must meet the same OS version requirements as company devices |
BYOD (Limited Access)
| Control | Requirement |
|---|---|
| Browser access only | Access to Carriyo systems limited to web browser sessions; no local data storage |
| Session management | Sessions must be logged out when not in active use; browser must not save Carriyo passwords |
| Minimum OS version | Current vendor-supported version |
| Screen lock | Required with minimum 6-digit PIN or biometric |
Mobile Application Management (MAM)
Managed Applications
The following categories of applications are managed under Carriyo's MAM policy when installed on mobile devices:
- Email and calendar applications (company-provisioned accounts)
- Messaging and collaboration applications
- Cloud storage applications (company-provisioned accounts)
- Authentication applications (authenticator app for MFA)
- Any application that accesses Carriyo APIs or data
MAM Controls
| Control | Description |
|---|---|
| Data isolation | Work data is isolated from personal data on the device |
| Copy/paste restriction | Copy and paste of data from managed work applications to unmanaged personal applications is blocked |
| Save-as restriction | Saving files from work applications to personal storage locations is blocked |
| App-level PIN | An additional PIN or biometric prompt may be required to open managed work applications |
| Encryption | Data within managed applications is encrypted independently of device-level encryption |
| Selective wipe | Work data and applications can be remotely wiped without affecting personal data |
Acceptable Use
Permitted Use
- Accessing Carriyo email, calendar, and messaging on enrolled mobile devices
- Using approved collaboration tools for work communication
- Accessing Carriyo cloud applications and dashboards
- Using the company authenticator app for multi-factor authentication
- Limited personal use of company-provided devices that does not compromise security or violate policy
Prohibited Use
- Storing Carriyo data classified as Restricted on any mobile device (company or BYOD) unless specifically authorized and encrypted
- Connecting mobile devices to untrusted or unknown USB ports (e.g., public charging stations) — use a power-only cable or portable battery instead
- Installing applications from untrusted sources (sideloading) on company devices
- Disabling or circumventing security controls, MDM/MAM agents, or encryption
- Using the device camera to photograph Confidential or Restricted information
- Sharing the device with unauthorized persons while work profiles or applications are accessible
- Using the device for any illegal activity or activity that could harm Carriyo's reputation
Lost, Stolen, or Compromised Devices
Reporting
- Lost or stolen devices must be reported to the Information Security Specialist and IT Administrator within 1 hour of discovery
- Devices suspected of being compromised (malware, unauthorized access) must be reported immediately
- Reporting follows the Incident Management Policy (CAR-ISMS-POL-011)
Response Actions
Upon report of a lost, stolen, or compromised device:
- Immediate — Remote wipe is initiated (full wipe for company devices; selective wipe of work data for BYOD)
- Immediate — Credentials associated with the device are reviewed and reset if necessary (email, SSO, VPN, MFA tokens)
- Within 24 hours — The device is removed from the device inventory and its access to Carriyo systems is revoked
- Investigation — The incident is investigated per the Incident Management Policy to determine if data was exposed
- Notification — If customer data or personal data may have been compromised, notification procedures are followed per the Data Protection Policy and applicable regulations
Device Decommissioning
Company-Provided Devices
When a company device is decommissioned (end of life, reassignment, or employee departure):
- Data backup — Any work data on the device is backed up to approved cloud storage
- Remote wipe — The device is wiped using the MDM platform (factory reset) once deployed; until then, the user is instructed to perform a factory reset and account sessions are revoked centrally
- MDM removal — The device is removed from the MDM inventory
- Verification — The wipe is verified before the device is reused, returned to stock, or disposed of
- Disposal — If the device is being disposed of, it is securely wiped or physically destroyed per the Data Retention and Disposal Policy (CAR-ISMS-POL-012)
- Record — The decommissioning is recorded in the device inventory
BYOD Decommissioning
When a BYOD user's relationship with Carriyo ends or the user no longer wishes to use their personal device for work:
- Selective wipe — The work profile, managed applications, and all Carriyo data are remotely wiped from the device
- MAM removal — The MAM agent or work profile is removed
- Access revocation — The device is removed from the device inventory and all Carriyo access from the device is revoked
- Confirmation — The user confirms that the work data removal is complete (for BYOD Limited Access users, confirmation that browser sessions are logged out and saved passwords are removed)
Device Inventory
The IT Administrator maintains a device inventory that includes:
| Field | Description |
|---|---|
| Device ID | Unique identifier (serial number or MDM device ID) |
| Device type | Make, model, OS version |
| Ownership | Company-provided or BYOD |
| Assigned user | Name and role |
| Enrolment date | Date the device was enrolled |
| Management level | Full MDM, MAM (Managed Access), or Limited Access |
| Status | Active, Lost/Stolen, Decommissioned |
| Last compliance check | Date of the most recent compliance verification |
The inventory is reviewed quarterly to identify inactive or non-compliant devices.
Responsibilities
| Role | Responsibilities |
|---|---|
| Information Security Specialist | Maintains this policy; defines device security standards and MAM configurations; reviews mobile device incidents; conducts periodic compliance checks; approves BYOD configurations |
| IT Administrator | Manages the MDM/MAM platform; processes device enrolment and decommissioning; executes remote wipe when required; maintains the device inventory; supports personnel with device configuration |
| CTO / Head of Engineering | Ensures MDM/MAM infrastructure is maintained and operational; approves technical changes to mobile device management configurations |
| Management (CISO) | Approves this policy; ensures adequate resources for mobile device security; addresses compliance escalations |
| All Personnel | Comply with this policy; maintain device security; report lost, stolen, or compromised devices immediately; complete BYOD enrolment before using personal devices for work; consent to MAM controls where required |
Review
This policy is reviewed annually or when significant changes occur to mobile device technology, Carriyo's device management approach, or the threat landscape for mobile devices. Updates are processed through the standard document control procedure (CAR-ISMS-PRC-001).
Enforcement
Violations of this policy may result in disciplinary action, up to and including termination of employment or contract. Non-compliant devices may be blocked from accessing Carriyo systems without notice. Repeated failure to comply with device security requirements or refusal to enrol required MAM controls may result in revocation of mobile access to Carriyo systems.