Frameworks / NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices / MD124-POL-01 NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices
Mobile Device Policies
NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices MD124-POL-01: Mobile Device Security Policy Develop a mobile device security policy addressing authorized devices, operating systems, security requirements, acceptable use, and consequences for non-compliance.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 67 controls across 35 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
ISO27043-06 Asset inventory and ownership ISO27043-08 Information classification and labeling ISO27043-10 Media management and disposal ISO21434-07 Acceptable use of assets ISO21434-08 Information classification and labeling ISO21434-09 Asset handling procedures NISTSP61-1 Incident Response Policy, Plan, and Procedures NISTSP61-3 Preparation: Communications, Toolkits, Training, Exercises, Threat Intelligence NISTSP61-4 Detection and Analysis: Sources, Triage, Categorisation, Prioritisation ASD37-12 Antivirus software with heuristics (Very Good) ASD37-16 Antivirus software with signatures (Limited) CPG-2.A Asset Inventory CPG-2.B Prohibit Connection of Unauthorized Devices NISTSP88-1 Media Sanitization Policy, Roles, and Decision Framework NISTSP88-5 Media Inventory, Tracking, Chain of Custody, and Sanitization Records NISTSP92-2 Log Generation: OS, Application, Security Tools, Network, Cloud, Required Event Content NISTSP92-7 Privacy in Logs, Sensitive Content Handling, Cloud and SaaS Log Considerations OWASPSAMM-2 Design: Threat Assessment, Security Requirements, Security Architecture OWASPSAMM-5 Operations: Incident Management, Environment Management, Operational Management SHAREASSESS-1 Information Governance and Risk SHAREASSESS-2 Access Control, Identity, Authentication AWWA-4.1 Malware Protection CAT-D3-1 Preventative controls FFIEC-07 Endpoint protection and detection ISO-19650-1-5 Delivery team and task team concepts 27010-8.1 Membership Onboarding NISTSP115-8 Operational Considerations - Tools, Reporting Templates, ISMS Integration, Annex Material NISTSP137-1 ISCM Strategy, Governance, and Volatility Assessment NISTSP63R4-7 Privacy, Records Retention, and User-Controlled Wallets NISTSP82-5 OT Configuration Management, Patching, Vulnerability Management, and Malware Protection QRCM-1.1 Cryptographic Asset Inventory OSFIB13-3 Cyber Security: Identification, Protection, Detection, Response, Recovery OMANCS-5 Network, Endpoint, System Development, and Configuration Security OPENBANK-3 Mutual TLS, Token Binding, Request Signing (JWS), Key Management OSSFSC-2 Dependency Management, Pinning, Updates, Vulnerability Tracking PCI-P2PE-07 Endpoint protection and detection PCI-PIN-07 Endpoint protection and detection PCI-SSF-07 Endpoint protection and detection PSDTWO-1 Strong Customer Authentication (SCA) Core Requirements PTESPHASE-1 Pre-Engagement Interactions and Scoping SUPCHAIN-1 Build Integrity - Source, Build, Provenance SIGSTORE-2 Transparency Log (Rekor) and Verification UKGAMBLE-4 Resilience and Incident Response CYB-3 Device Security Measures Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in Mobile Device Policies Query this from an agent The graph holds this control, the 67 it maps to, and the evidence behind each claim, over MCP and REST.