FFIEC IT Examination Handbook IS-II.C.15(d): II.C.15(d) Use of Remote Devices (Information Security)

What does IS-II.C.15(d) require?

For every remote device, institution-owned or BYOD, remote access is disallowed without compelling business justification, approved by management, reviewed regularly with unjustified approvals rescinded, restricted to authorised network areas and applications by VLANs and permissions, logged with date, time, user, location, duration and activity and analysed with follow-up, robustly authenticated, encrypted and controlled by application whitelisting; institution-owned devices are securely configured, protected against malware, patched, encrypted, given secure containers for sensitive data, periodically audited and remotely wipeable.