ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 7.4: Secure virtual environments: BYOD and virtual machine controls, device posture checks, remote wipe, data transfer policies and vetted web and mobile services

What does 7.4 require?

Where non-corporate devices may reach corporate resources, measures prevent unauthorised access and data loss; virtual machines are governed through their lifecycle, configured to standard, regularly updated, with data stored securely and controls such as memory encryption against loss from the connecting device; mobile application access to corporate resources is governed by solutions that secure access and use; where possible the security posture of non-corporate devices is assessed before access, with outdated, jailbroken or infected devices denied unless the virtual machine or application robustly insulates corporate resources, and corporate data can be remotely wiped from lost or stolen devices; strict policies govern what data or programs may move in or out of a virtual machine or mobile application. Internet work automation and collaboration services and commercial productivity mobile applications receive due diligence on track record, service standards, resilience, business fit and past incidents, with management approval before use.