Mobile Device

Objective: 

This policy defines measures necessary to secure university mobile computing devices that access or store SFSU sensitive data. The measures specified herein must be followed to protect university data and ensure compliance with Federal, State, CSU and SFSU regulations governing security of information.  Only SFSU owned devices are approved for use with sensitive data. 

Definitions:

Mobile device 
Computing devices that use a mobile operating system (for example, iOS or Android) excluding traditional Internet of Things (IoT) devices such as sensors or cameras.

Sensitive data (Levels 1 and 2) 
Campus data is classified according to its potential risk which is governed by federal and state laws. Sensitive data includes confidential (Level 1) and internal use (Level 2) data classifications. See the Sensitive Data Policy for more information.

Statement: 

User Practice for Securing Devices

Sensitive data (Levels 1 and 2) must not be accessed or stored from mobile devices unless:

1. The device is university-owned
2. There is a documented business need for the sensitive data to be accessed or stored by the mobile device
3. Appropriate security measures have been implemented to protect the data, such as high risk workstation controls or equivalent
4. Full-device or container encryption is enabled, where appropriate

Required Mobile Device Security Measures

General security measures for mobile devices used for university business:

• Follow the security incident management procedure if a mobile device containing SFSU Sensitive Data is compromised, lost or stolen
• Frequently check for and install any available operating system and application security updates
• Only download apps from official app stores (Apple App Store, Google Play, etc.)
• Remove or refrain from downloading non-essential apps
• Do not leave unencrypted mobile devices unattended
• Regularly backup the mobile device to protect data in the event of loss, theft, or lockout

Device Access Security Measures

• Mobile devices that access or store sensitive data must be locked during inactivity
• Unlocking requires strong authentication, such as: a passcode, or password, or biometric functionality
  • If using a password, it should comply with the SF State Password Policy.
  • Biometric functionality (e.g. facial recognition, fingerprint scanner) and complex passcodes must be enabled if available.

Required Sensitive Data Security Measures

Sensitive data security measures apply to mobile devices that access or store data classified as confidential level 1 and internal use level 2. 

• Use public, untrusted wireless networks with caution, preferably in conjunction with SFSU VPN
• Use wireless networks that support reliable encryption (802.1x)
• Auto-wipe device after 10 failed login attempts
• Maintain a backup of data and use it to restore the device if inadvertently wiped
• Configure device to be remotely wiped in the case it is lost or stolen
• Wipe or securely delete data from mobile devices before disposing, reselling, or trading them in.

Required Confidential (level 1) Data Security Measures

Security measures for securing mobile devices that access or store confidential level 1 data:

• Conduct a formal risk assessment before installing applications that are not part of the device’s base distribution
• Limit access to the device to those that need to access the confidential data
• Confirm device is encrypted
• Disable Bluetooth and wireless access when not needed
• Use SFSU's VPN when accessing confidential (level 1) data
• Documented Administrator Approval is required for storing confidential (level 1) data on a mobile device.

Implementation

Responsibility for implementing this Policy will rest with ITS and Information Technology (IT) departments across campus. Submit any apparent violation of Password Policy to the appropriate administrative authority (vice president, dean, director, department, or program chair).

Non-Compliance

Noncompliance with applicable policies and/or practices may result in suspension of network and systems access privileges. In addition, disciplinary action may be applicable under other University policies, guidelines, implementing procedures, or collective bargaining agreements.