Title

Personally owned or contractor owned mobile devices must not be used to transmit, receive, store, or process DoD information or connect to DoD networks. (Cat II impact)

Discussion

The use of unauthorized personally-owned CMDs to receive, store, process, or transmit DoD data could expose sensitive DoD data to unauthorized people. The DoD CIO currently prohibits the use of personally owned or contractor owned mobile devices (Bring Your Own Device – BYOD).

Check Content

Interview the site IAM and IAO and determine if personally owned or contractor owned CMDs (Bring Your Own Device – BYOD) are used at the site to transmit, receive, store, or process DoD information or connect to DoD networks. Mark as a finding if personally owned or contractor owned CMDs (Bring Your Own Device – BYOD) are used to transmit, receive, store, or process DoD information or connect to DoD networks.

Fix Text

Prohibit use of personally owned or contractor owned mobile devices (Bring Your Own Device – BYOD) at the site to transmit, receive, store, or process DoD information or connect to DoD networks.

Additional Identifiers

Rule ID: SV-104677r1_rule

Vulnerability ID: V-94847

Group Title: Personally-owned mobile devices (BYOD)

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.