Mobile Device

Mobile device is a portable computing device capable of connecting to a network to provide the user with access to data services or other computing services.  This includes, but is not limited to, mobile phones, smartphones, tablets, laptops, or hybrid devices.

University-owned device is a mobile device, purchased and owned by the University.

Personally-owned device is a mobile device, purchased and owned by an individual.

Non-public (or UNCG) resources are resources, data, or systems that require UNCG credentials to access.

Connected Things refers to any Personally-owned wearable or miscellaneous device (including, but not limited to, smartwatches, Fitbits, and augmented reality [AR]/virtual reality [VR] devices) which connect to a University-owned device, or to the UNCG network.

Users refers to all persons including, but not limited to, University employees, students, contractors, consultants, suppliers, customers, government or academic agencies, all personnel affiliated with third parties, and non-affiliated visitors using UNCG-owned or Personally-owned mobile devices that access the University’s networks, data, or systems.

Restricted Systems include access-controlled software or other non-public (or UNCG) information systems that contain or manage moderate- to high-risk data (e.g. Banner, Genie, etc.)

Mobile device users of the University’s information resources have the responsibility to take appropriate measures to protect mobile devices and University assets accessed by the device. 

1. The device must be physically protected from loss, theft, and compromise.
2. The device must be protected with a pin, password, passcode, or similar authentication mechanism, if supported by the device.
3. Users must take appropriate precautions to prevent others from obtaining access to their mobile device(s). Users will be responsible for all transactions made with their credentials, and should not share individually assigned passwords, PINs, or other credentials.
4. Storing or accessing sensitive data in any way that violates the University’s Data Classification Policy is prohibited.
5. Storing unencrypted non-public (or UNCG) resources on the device is prohibited.
6. The device operating system version must receive software security updates from the device provider. Unsupported end-of-life operating systems and software are not permitted.
7. Third party software installed on the device may not compromise the security of University data or systems.
8. If a mobile device used to access, store, or manipulate non-public University data is lost, stolen, or compromised, the User must promptly notify management, or the ITS Service Desk so appropriate steps may be taken to protect non-public (or UNCG) resources and systems.
9. Users should not access restricted systems from Personally-owned devices, even if it is technically possible. Failure to comply with this provision may result in disciplinary action.
10. Mobile devices and Connected Things must be wiped of all University data prior to sale or disposal of the device, or when a User separates from the University.
11. In the (unlikely) event that the University needs access to either a University- or Personally-owned device, mobile device data is subject to the North Carolina Public Records Act (NCGS Chapter 132) and (“E-discovery”), including public information requests, subpoenas, court orders, litigation holds, and other requirements applicable to University Information Resources. Should this occur, Users must provide access to the subject device.

The following requirements apply to all University-owned mobile devices that access, store, or manipulate non-public (or UNCG) resources:

1. Each device must be configured by University support staff using an ITS provided configuration with full disk encryption.
2. Devices may not be used by individuals who are not authorized University Users.
3. Departments must maintain an inventory of mobile devices assigned to employees. Departments are responsible for recovery and appropriate disposal of mobile devices.
4. University maintains the right to wipe the device entirely of its contents if it is lost, stolen, retired, or otherwise compromised, or when the User is separated from the University through resignation, termination, or layoff.
5. Users are responsible for upgrades, including backing up and restoring data as part of the upgrade process. Users are solely responsible for backing up any personal content on the device, as that information cannot ultimately be protected by selective wipes.
6. Loss or theft of the device must be immediately reported by the user to the employee’s management and to the ITS Service Desk. University Police shall be notified in cases of theft.

The following requirements apply to all Personally-owned mobile devices that access, store, or manipulate non-public (or UNCG) resources:

1. Personal use of the device may not compromise the security of UNCG data or systems.
2. All Users must select strong passwords and change passwords in accordance with the UNCG password requirements.
3. All Personally-owned mobile devices must be configured with a minimum password length of six alphanumeric characters or use an acceptable biometric solution for authentication.
4. All Personally-owned mobile devices must be secured with a password-protected screen saver when left unattended and must be configured to automatically lock after a predefined period of inactivity.
5. All Connected Things must operate in a manner that does not interfere with, disrupt, or otherwise degrade the performance of University-issued connected devices and network-dependent services

• Acceptable Use of Electronic Computing Resources Policy
• Information Security Policy
• Information Security Incident Reporting and Notification Policy
• Data Classification Policy

Portions of this document were informed by the language found in the ISO/IEC 27002:2013 Standard (section 6.2.1 Mobile Device policy)

The Chancellor is responsible for approval of this Policy.

• Responsible Executive: Donna R. Heath, Vice Chancellor for Information Technology Services and Chief Information Officer (CIO), [email protected]
• Responsible Administrator: Casey J. Forrest, Chief Information Security Officer (CISO), [email protected]