MDM-02: Access Control For Mobile Devices
Mechanisms exist to enforce access control requirements for the connection of mobile devices to organizational Technology Assets, Applications and/or Services (TAAS).
Control Question: Does the organization enforce access control requirements for the connection of mobile devices to organizational Technology Assets, Applications and/or Services (TAAS)?
General (32)
| Framework | Mapping Values |
|---|---|
| CSA CCM 4 | UEM-12 |
| GovRAMP Low | AC-19 |
| GovRAMP Low+ | AC-19 |
| GovRAMP Moderate | AC-19 |
| GovRAMP High | AC-19 |
| ISO 27002 2022 | 8.1 |
| ISO 27017 2015 | 6.2.1 |
| MITRE ATT&CK 10 | T1020.001, T1040, T1070, T1070.001, T1070.002, T1114, T1114.001, T1114.002, T1114.003, T1119, T1530, T1550.001, T1552, T1552.004, T1557, T1557.002, T1558, T1558.002, T1558.003, T1558.004, T1565, T1565.001, T1565.002, T1602, T1602.001, T1602.002 |
| NIST 800-53 R4 | AC-19 |
| NIST 800-53 R4 (low) | AC-19 |
| NIST 800-53 R4 (moderate) | AC-19 |
| NIST 800-53 R4 (high) | AC-19 |
| NIST 800-53 R5 (source) | AC-19 |
| NIST 800-53B R5 (low) (source) | AC-19 |
| NIST 800-53B R5 (moderate) (source) | AC-19 |
| NIST 800-53B R5 (high) (source) | AC-19 |
| NIST 800-82 R3 LOW OT Overlay | AC-19 |
| NIST 800-82 R3 MODERATE OT Overlay | AC-19 |
| NIST 800-82 R3 HIGH OT Overlay | AC-19 |
| NIST 800-161 R1 | AC-19 |
| NIST 800-161 R1 C-SCRM Baseline | AC-19 |
| NIST 800-161 R1 Level 2 | AC-19 |
| NIST 800-161 R1 Level 3 | AC-19 |
| NIST 800-171 R2 (source) | 3.1.18 |
| NIST 800-171A (source) | 3.1.18[a] 3.1.18[b] 3.1.18[c] |
| NIST 800-171 R3 (source) | 03.01.18.a 03.01.18.b |
| NIST 800-171A R3 (source) | A.03.01.18.b |
| NIST 800-207 | NIST Tenet 1 |
| SCF CORE Mergers, Acquisitions & Divestitures (MA&D) | MDM-02 |
| SCF CORE ESP Level 1 Foundational | MDM-02 |
| SCF CORE ESP Level 2 Critical Infrastructure | MDM-02 |
| SCF CORE ESP Level 3 Advanced Threats | MDM-02 |
US (21)
| Framework | Mapping Values |
|---|---|
| US CERT RMM 1.2 | TM:SG4.SP1 TM:SG4.SP2 |
| US CJIS Security Policy 5.9.3 (source) | AC-19 5.13.2 5.13.6 5.13.7 5.13.7.1 5.13.7.2 |
| US CMMC 2.0 Level 2 (source) | AC.L2-3.1.18 |
| US CMMC 2.0 Level 3 (source) | AC.L2-3.1.18 |
| US CMS MARS-E 2.0 | AC-19 |
| US FedRAMP R4 | AC-19 |
| US FedRAMP R4 (low) | AC-19 |
| US FedRAMP R4 (moderate) | AC-19 |
| US FedRAMP R4 (high) | AC-19 |
| US FedRAMP R4 (LI-SaaS) | AC-19 |
| US FedRAMP R5 (source) | AC-19 |
| US FedRAMP R5 (low) (source) | AC-19 |
| US FedRAMP R5 (moderate) (source) | AC-19 |
| US FedRAMP R5 (high) (source) | AC-19 |
| US FedRAMP R5 (LI-SaaS) (source) | AC-19 |
| US HIPAA HICP Large Practice | 2.L.B |
| US IRS 1075 | AC-19 |
| US NISPOM 2020 | 8-610 |
| US - TX DIR Control Standards 2.0 | AC-19 |
| US - TX TX-RAMP Level 1 | AC-19 |
| US - TX TX-RAMP Level 2 | AC-19 |
EMEA (4)
| Framework | Mapping Values |
|---|---|
| EMEA Israel CDMO 1.0 | 4.27 13.2 13.3 13.5 13.7 13.9 |
| EMEA Saudi Arabia CSCC-1 2019 | 2-5-1-1 |
| EMEA Saudi Arabia ECC-1 2018 | 2-6-3-2 5-1-3-6 |
| EMEA Saudi Arabia SACS-002 | TPC-84 |
APAC (1)
| Framework | Mapping Values |
|---|---|
| APAC Japan ISMAP | 6.2.1 |
Americas (1)
| Framework | Mapping Values |
|---|---|
| Americas Canada ITSP-10-171 | 03.01.18.A 03.01.18.B |
Capability Maturity Model
Level 0 — Not Performed
There is no evidence of a capability to enforce access control requirements for the connection of mobile devices to organizational Technology Assets, Applications and/or Services (TAAS).
Level 1 — Performed Informally
C|P-CMM1 is N/A, since a structured process is required to enforce access control requirements for the connection of mobile devices to organizational Technology Assets, Applications and/or Services (TAAS).
Level 2 — Planned & Tracked
Mobile Device Management (MDM) efforts are requirements-driven and governed at a local/regional level, but are not consistent across the organization. CMM Level 2 control maturity would reasonably expect all, or at least most, the following criteria to exist: o Identify cybersecurity and data protection controls to address applicable statutory, regulatory and contractual requirements for Mobile Device Management (MDM). o Implement and maintain a MDM capability for all mobile devices in use at the organization.
- Mobile device management is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
- IT/cybersecurity personnel:
- Organization-owned mobile devices are configured to protect data with the strength and integrity commensurate with the classification or sensitivity of the information stored on the device and mostly conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides), including cryptographic protections for sensitive/regulated data.
- MDM software is used to restrict the data that is stored/processed/transmitted on organization-owned and/ or applicable Bring Your Own Device (BYOD) (e.g., personal devices).
- Administrative processes and technologies restrict the connection of personally-owned, mobile devices to organizational Technology Assets, Applications and/or Services (TAAS) and networks.
Level 3 — Well Defined
Mobile Device Management (MDM) efforts are standardized across the organization and centrally managed, where technically feasible, to ensure consistency. CMM Level 3 control maturity would reasonably expect all, or at least most, the following criteria to exist:
- An Identity & Access Management (IAM) function, or similar function, performs the implementation of access controls for mobile devices that restricts the connectivity of mobile devices from communicating with Technology Assets, Applications and/or Services (TAAS), applications and services.
- Administrative processes and technologies restrict the connection of personally-owned, mobile devices to organizational Technology Assets, Applications and/or Services (TAAS) and networks.
- Organization-owned mobile devices are configured to protect data with the strength and integrity commensurate with the classification or sensitivity of the information stored on the device, and conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides), including cryptographic protections for sensitive/regulated data.
- MDM software is used to restrict the data that is stored/processed/transmitted on organization-owned and/ or applicable Bring Your Own Device (BYOD) (e.g., personal devices) across the entire organization.
- MDM enforces a separate device workspace on applicable mobile devices to separate work-related and personal-related applications and data.
- Technologies are configured to use cryptographic mechanisms to protect the confidentiality and integrity of information on mobile devices through full-device or container encryption.
Level 4 — Quantitatively Controlled
Mobile Device Management (MDM) efforts are metrics driven and provide sufficient management insight (based on a quantitative understanding of process capabilities) to predict optimal performance, ensure continued operations and identify areas for improvement. In addition to CMM Level 3 criteria, CMM Level 4 control maturity would reasonably expect all, or at least most, the following criteria to exist:
- Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
- Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
- Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
- Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
- Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
- Both business and technical stakeholders are involved in reviewing and approving proposed changes.
Level 5 — Continuously Improving
See C|P-CMM4. There are no defined C|P-CMM5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to enforce access control requirements for the connection of mobile devices to organizational Technology Assets, Applications and/or Services (TAAS).
Assessment Objectives
- MDM-02_A01 configuration requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area.
- MDM-02_A02 connection requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area.
- MDM-02_A03 implementation guidance is established for organization-controlled mobile devices, including when such devices are outside of the controlled area.
- MDM-02_A04 the connection of mobile devices to the system is authorized.
- MDM-02_A05 mobile devices that process, store or transmit sensitive / regulated data are identified.
- MDM-02_A06 mobile device connections are monitored and logged.
Technology Recommendations
Micro/Small
- Microsoft Entra (https://microsoft.com)
- AWS IAM (https://aws.amazon.com)
Small
- Microsoft Entra (https://microsoft.com)
- AWS IAM (https://aws.amazon.com)
Medium
- Microsoft Entra (https://microsoft.com)
- AWS IAM (https://aws.amazon.com)
Large
- Microsoft Entra (https://microsoft.com)
- AWS IAM (https://aws.amazon.com)
Enterprise
- Microsoft Entra (https://microsoft.com)
- AWS IAM (https://aws.amazon.com)