Mobile devices with information storage capability may only be used to store Agency information if the mobile device employs a password/PIN functionality that prevents unauthorized access to the device. Confidential information may not be stored on mobile devices without the authorization of the chief information security officer.
Inadequate procedures for handling media (disclosure, modification, removal, and destruction) may result in potential compromise of information by unauthorized parties.
The organization [Selection: restricts; prohibits] the use of [Assignment: organization-defined types of information system media] on [Assignment: organization-defined information systems or system components] using [Assignment: organization-defined security safeguards].
Policy or procedures prohibit use of certain types of media.
The state organization restricts the use of mobile devices with information storage capability, based on documented risk management decisions.
Obtain procedures relating to media use and ascertain if:
(i) security safeguards ensure that prohibited or restricted media are not used on information systems; and
(ii) portable storage devices with no identifiable owner are not used on information systems.
