Frameworks / NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices / MD124-POL-03 NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices
Mobile Device Policies
NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices MD124-POL-03: Mobile Data Protection Policy Define data protection requirements for mobile devices including encryption, data loss prevention, and restrictions on sensitive data storage and transmission.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 543 controls across 186 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
CH-FADP-13 Right to object and request blocking CH-FADP-19 Transparency and proactive information CH-FADP-21 Data protection impact assessments FADP-16 FDPIC Independence and Functions FADP-5 Definitions (Article 5) FADP-7 Data Protection Impact Assessment (Articles 9-10) FADP-9 Data Protection Advisor (Articles 14-15) 27011-1 Scope 27011-3 Terms and definitions 27011-5.2 Information Security Roles in Telecoms 27011-6.3 Awareness and Training 27011-8.3 Cryptography and key management 27011-8.6 Data protection and backup NDPA-1 Applicability, Scope, and Carve-Outs NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal NDPA-4 Sensitive Data Processing Consent and Childrens Protections NDPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation NDPA-7 Data Protection Assessments and Processor Contracts NDPA-8 Nebraska Attorney General Enforcement, Permanent 30-Day Cure, and Penalties NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission NG-NDPA-2 Lawful Basis, Consent, and Data Protection Principles NG-NDPA-4 Data Subject Rights and Automated Decision-Making NG-NDPA-5 Security of Processing, Breach Notification, and DPIA NG-NDPA-7 Cross-Border Data Transfers and International Cooperation NG-NDPA-8 Enforcement, Penalties, Data Controllers of Major Importance (DCMI), and Compliance AT-DSG-10 Section 29 - Liability and right to compensation / civil jurisdiction AT-DSG-12 Section 62 - Administrative penalties AT-DSG-2 Section 2 - Scope and application AT-DSG-7 Section 18 - Establishment of the Data Protection Authority AT-DSG-8 Section 22 - Functions and powers of the DPA FEDRAMP-CM-6 Configuration Settings FEDRAMP-CP-9 System Backup FEDRAMP-SC-13 Cryptographic Protection FEDRAMP-SC-28 Protection of Information at Rest FEDRAMP-SC-8 Transmission Confidentiality and Integrity ISO27799-02 ePHI encryption at rest and in transit ISO27799-03 Minimum necessary standard enforcement ISO27799-04 Patient data de-identification procedures ISO27799-05 Audit trail for ePHI access ISO27799-16 Transmission security and encryption ISO27043-04 Roles and responsibilities definition ISO27043-17 Encryption of data at rest ISO27043-18 Encryption of data in transit ISO27043-19 Certificate management ISO27043-20 Key lifecycle management ISO21434-04 Roles and responsibilities definition ISO21434-16 Cryptographic policy and key management ISO21434-17 Encryption of data at rest ISO21434-18 Encryption of data in transit ISO21434-19 Certificate management NRC7354-2 Critical Digital Asset (CDA) Identification, Scope, and Boundary NRC7354-4 Security Controls Implementation per NRC RG 5.71 Appendix B/C RG5.71-C.3 Cyber Security Training RG5.71-C.5 Recovery and Restoration RG5.71-C.6 Configuration Management TRINIDAD-1 Scope, Definitions, Commission TRINIDAD-2 Lawful Processing and Consent TRINIDAD-3 Data Subject Rights TRINIDAD-4 Security, Accuracy TRINIDAD-5 Enforcement and Sanctions 23837-1.1 Scope 23837-1.2 Normative references 23837-1.5.2 Cryptographic module requirements 23837-1.5.3 Network device testing requirements ISO23894-1 Scope of AI Risk Management ISO23894-3 AI-Specific Terminology ISO23894-6.2 Scope, Context and Criteria ISO23894-A.5 Privacy and Data Protection in AI 27400-3 Terms and definitions 27400-6.2 Device Identity and Authentication 27400-7.1 Network Security for IoT 27400-7.4 Data retention and deletion MTCS-Acquisition-Development-Maintenance-Supplier-Vulnerability-DevSecOps-SBOM-SDLC-SCA-API-Container MTCS Acquisition + Development + Maintenance + Supplier + Vulnerability + DevSecOps + SBOM + SDLC + SCA MTCS-Governance-ISMS-Risk-HR-Lifecycle-Compliance-Cloud-Strategy-Roles-Responsibilities MTCS Governance + ISMS + Risk Management + HR Security + Cloud Service Lifecycle + Compliance + Roles MTCS-Logging-Monitoring-Compliance-Audit-SLA-Configuration-SIEM-SOAR-Cloud-Monitoring-CSPM MTCS Logging + Monitoring + Compliance + Audit + SLA + Configuration + SIEM + SOAR + CSPM MTCS-Operations-Physical-Network-Tier-III-Data-Centre-Hardening-Patching-Network-Segmentation-DDoS MTCS Operations + Physical + Network + Tier III Data Centre + Hardening + Patching + Segmentation + DDoS IM8-CLD.2 Cloud Security Controls IM8-DAT.2 Data Protection IM8-DAT.4 Data Retention and Disposal IM8-RES.2 Disaster Recovery AWWA-1.1 Security Policy and Governance AWWA-3.2 Remote Access Security AWWA-3.4 Encryption and Data Protection AL-DPA-1 Scope and Definitions AL-DPA-14 Direct Marketing AL-DPA-3 Lawful Basis for Processing AZ-DPA-15 Article 17 - Dispute resolution AZ-DPA-2 Article 2 - Basic Concepts AZ-DPA-6 Article 6 - State regulation in personal data protection BB-DPA-1 Section 1 - Short Title BB-DPA-2 Section 2 - Interpretation BB-DPA-4 Section 4 - Principles Relating to Processing DA-1 Enterprise Data Architecture DIQ-2 Data Quality Management RMD-1 Reference Data Management UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5) FDBR-702 Definitions (§501.702) FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) IEC62304-5.2 Software Requirements Analysis IEC62304-5.3 Software Architectural Design IEC62304-7.2 Risk Control Measures ISO-15189-5.1 Legal entity ISO-15189-5.4 Structure and authority ISO-15189-6.7 Service agreements ISO-19650-1-4 Information management concepts ISO-19650-1-7 Common Data Environment (CDE) concept ISO-19650-3-5.3 Trigger events for information exchange ISO-22320-5.1 General process requirements ISO-22320-5.3 Incident management structure (command) ISO-22320-5.4 Roles and responsibilities 27004-3 Terms and definitions 27004-A.2 Patching and Vulnerability Measures 27004-B.1 Example measurement definitions 27557-1 Scope 27557-3 Terms and definitions 27557-6.2 Scope, context, and criteria for privacy 29100-1 Scope 29100-3 Terms and definitions 29100-4.1 Actors and roles MU-DPA-Cross-Border-Transfer-Section-36-Adequacy-SCC-BCR-Mauritius-Global-Business-IBC-Financial-Services Mauritius DPA Cross-Border + Section 36 + Adequacy + SCC + BCR + Mauritius Global Business + Financial Services MU-DPA-Security-Breach-Notification-Section-25-BREACH-72-Hour-Commissioner-Cyber-Security-Strategy Mauritius DPA Security + Breach Notification + Section 25-BREACH + 72 Hour + Commissioner + Cyber Security Strategy MU-DPA-Sensitive-Personal-Data-Section-24-Health-Biometric-Genetic-Sexual-Section-25-Children-16 Mauritius DPA Sensitive Data + Section 24 + Health + Biometric + Genetic + Sexual + Section 25 + Children 16 MX-LFPDPPP-Cross-Border-Transfer-Articles-36-37-Reglamento-66-68-Domestic-International-APEC-CBPR-USMCA Mexico LFPDPPP Cross-Border + Articles 36-37 + Reglamento 66 + 68 + Domestic + International + APEC CBPR + USMCA MX-LFPDPPP-Security-Breach-Notification-Reglamento-63-No-Time-Limit-INAI-Recommendations-CERT-MX Mexico LFPDPPP Security + Breach Notification + Reglamento 63 + No Specified Time + INAI Recommendations + CERT-MX MX-LFPDPPP-Sensitive-Article-3-VI-Genetic-Health-Sexual-Religious-Article-9-Minors-18-Parental-Consent Mexico LFPDPPP Sensitive Data + Article 3 Section VI + Genetic + Health + Sexual + Religious + Article 9 Minors + Parental Consent NISTPF-4 Communicate-P - Privacy Notice, Transparency, and Individual Awareness NISTPF-7 Protect-P Maintenance and Protective Technology (PR.MA-P, PR.PT-P) NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) NISTSP144-1 Cloud Governance, Risk Assessment, and Provider Trust Evaluation NISTSP144-3 Data Classification, Handling, and Sovereignty NISTSP144-5 Identity and Access in Cloud, Federation, and Privileged Access NISTSP145-3 Rapid Elasticity Characteristic and Capacity Management NISTSP145-7 Cloud Procurement Standards Aligned to NIST SP 800-145 Definition NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition NISTSP146-1 Cloud Adoption Strategy, Workload Suitability, and Decision Framework NISTSP146-6 Cloud Security and Privacy Recommendations NISTSP146-7 Service Level, Performance, Reliability, Interoperability, and Portability NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration NISTSP82-2 OT Risk Assessment and Threat/Vulnerability Identification NISTSP82-7 OT Incident Response, Forensics, Recovery, and Continuity NISTSP92-1 Log Management Programme, Policy, Roles, and Operational Runbooks NISTSP92-3 Log Infrastructure: Architecture, Centralisation, Transport Security, SIEM Governance NISTSP92-4 Log Management: Time Synchronisation, Parsing, Storage, Integrity, Access Control QRCM-1.2 Quantum-Vulnerable Identification QRCM-3.1 Hybrid Solution Deployment (2025-2030) QRCM-4.2 TLS 1.3 Adoption NHPA-6 Reasonable Data Security and Breach Response NHPA-7 Data Protection Assessments and Processor Contracts NHPA-8 AG Formella Enforcement, Permanent 60-Day Cure, and Penalties ORANWG11-2 O-RAN Interface Security: E2, A1, O1, O2, Open Fronthaul ORANWG11-3 Cryptography, TLS, SSH, IPsec, and PKI Lifecycle Management ORANWG11-6 Security Test Specifications, Certification, and Conformance OREGONCPA-5 Data Protection Assessments, Privacy by Design, Security Practices OREGONCPA-7 Processor Contracts, Cross-Border Transfers, DPAs OREGONCPA-8 Cure Period, Attorney General Enforcement, Training, Compliance Monitoring PDPASG-1 Accountability, Records, DPO Appointment, and Training PDPASG-4 Children's Data, DPIA, and Privacy by Design PDPASG-5 Protection, Accuracy, and Security of Personal Data PDPATH-4 DPIA, Privacy by Design, Children's Data PDPATH-5 Security Measures and Data Protection PDPATH-7 DPO, Records of Processing, Retention, Marketing, Training PICSGMP-2 Chapter 2: Personnel - Qualified Personnel, Key Responsibilities, Training PICSGMP-5 Chapter 5: Production Operations and Material Management PICSGMP-7 Chapter 7: Outsourced Activities and Supplier Management POPIASA-4 Special Personal Information, Children, Information Quality, Documentation POPIASA-5 Security Safeguards, Encryption, Access Control, Operator Obligations POPIASA-7 Information Officer, Records of Processing, Notification, Training PTESPHASE-1 Pre-Engagement Interactions and Scoping PTESPHASE-2 Intelligence Gathering (OSINT) PTESPHASE-3 Threat Modeling NORWAY-4 DPIA, Privacy by Design, Records of Processing NORWAY-5 Security of Processing, Encryption, Pseudonymization, Access Control NORWAY-7 DPO, Cooperation with Datatilsynet, Retention, Marketing, Training NZPRV-2 IPP 5 Storage and Security of Personal Information NZPRV-6 IPP 13 Unique Identifiers, Privacy Impact Assessment, Privacy by Design NZPRV-8 Privacy Officer, OPC Cooperation, Compliance Notices, Complaints, Training SA-PDPL-13 Encryption of personal data SA-PDPL-19 Data protection officer designation SA-PDPL-21 Data protection impact assessments Section 6(5) Definition of Foreign Public Official Section 8 Definition of Associated Person UKBRIBE-3 Due Diligence on Third Parties UKGDPRREG-1 Subject Matter, Scope, Principles (Articles 1-11) UKGDPRREG-2 Data Subject Rights (Articles 12-22) UKGDPRREG-3 Controller and Processor (Articles 24-43) OB-OPS.2 Performance Standards OB-SEC.2 Transport Layer Security OB-SEC.4 Certificate Management UGA-3 Accountability Principle UGA-6 Personal Data Protection Office UGA-7 Data Protection Officer URUGUAY-3 Sensitive Data, Health Data, Children URUGUAY-4 Security and Cross-Border URUGUAY-5 Database Registration with AGESIC URCDP 58.1 Scope 58.3 Definitions ASD37-17 TLS encryption between email servers (Limited) ASD37-27 Outbound data loss prevention (Very Good) MLE.1 Machine Learning Requirements Analysis MLE.3 Machine Learning Training CJIS-8 Media Protection CJIS-9 System and Communications Protection FFIEC-05 Roles and responsibilities definition FFIEC-09 Encryption and key management FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) 60601-1.3 Terminology and definitions 60601-1.4.1 General requirements 62351-2 Glossary of terms 62351-9 Cyber security key management ISO-20400-4.2 Principles of sustainable procurement ISO-20400-7.2 Integrating sustainability into specifications ISO-41001-4.1 Understanding the organization and its context ISO-41001-4.3 Determining the scope of the FM management system ISO-56002-4.3 Determining the scope of the innovation management system ISO-56002-8.3.4 Develop solutions ISO8000-DQM-02 Data Quality Dimensions ISO8000-MDG-03 Continuous Improvement ISO-17025-5.1 Legal entity ISO-17025-5.4 Personnel for the management system ISO-25012-5.2 Defining data quality measures ISO-25012-5.3 Planning and performing data quality evaluations 27014-1 Scope 27014-3 Terms and definitions 29115-3 Terms and definitions 29115-7.4 Level of Assurance 4 (LoA4) 29147-3 Terms and definitions 29147-9.2 Contact mechanisms and scope 30111-3 Terms and definitions 30111-5.1 Organizational policy MDS2-Audit-Logging-AUDT-Integrity-IGAU-Cybersecurity-Risk-CYBR-Monitoring MDS2 Audit Controls + AUDT + Integrity + IGAU + Cybersecurity Risk + CYBR + Continuous Monitoring MDS2-PHI-Data-Handling-DATA-Storage-STCF-Transmission-TXCF-TXIG-Encryption-FIPS MDS2 PHI Handling + DATA + STCF Storage + TXCF Transmission + TXIG Integrity + Encryption + FIPS MY-PDPA-DPO-Designation-Class-Data-User-Registration-DPIA-Code-Practice-Section-43A-2024-Amendment Malaysia PDPA Governance + DPO Section 43A + Class of Data User Registration + DPIA + Code of Practice MY-PDPA-Sensitive-Personal-Data-Section-40-Health-Religious-Political-Sexual-Children-Explicit-Consent Malaysia PDPA Sensitive Personal Data + Section 40 + Health + Religious + Political + Children + Explicit Consent MN-CDPA-Data-Privacy-Assessment-DPIA-Section-325O-07-Sensitive-Targeted-Sale-Profiling-AI-Consumer-Health Minnesota CDPA DPIA + Section 325O.07 + Sensitive + Targeted + Sale + Profiling + AI + Consumer Health MN-CDPA-Universal-Opt-Out-GPC-Sensitive-Data-Section-325O-02-Consumer-Health-Data-Children-Known-Child-Transgender Minnesota CDPA Universal Opt-Out + GPC + Sensitive + Section 325O.02 + Consumer Health Data + Children + Known Child + Transgender MT-CDPA-Data-Protection-Assessment-MCA-30-14-2815-Sensitive-Targeted-Sale-Profiling-AG-Inspection Montana CDPA Data Protection Assessment + MCA 30-14-2815 + Sensitive + Targeted + Sale + Profiling + AG Inspection MT-CDPA-Universal-Opt-Out-Mechanism-1-January-2025-GPC-Global-Privacy-Control-Mandatory-Recognition Montana CDPA Universal Opt-Out Mechanism + 1 January 2025 + GPC + Global Privacy Control + Mandatory Recognition NAIC-1 NAIC Model Law Adoption, Scope, and Licensee Definitions NAIC-2 Information Security Program (ISP) - Section 4 STANAG-1 STANAG 4774 Confidentiality Label Schema and XML Structure STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties NISTSP115-1 Scope, Methodology, and Assessment Planning NISTSP115-8 Operational Considerations - Tools, Reporting Templates, ISMS Integration, Annex Material NISTSP122-5 PII Security Controls - Encryption, Access Control, Storage, Audit NISTSP122-8 Continuous Monitoring, Training, and Privacy Programme Governance NISTSP123-4 Server Cryptography - Encryption, Key Management, Certificates NISTSP123-8 Governance, Policies, and ISMS Integration NISTSP137-1 ISCM Strategy, Governance, and Volatility Assessment NISTSP137-5 Vulnerability + Patch + Configuration Status Monitoring NISTSP61-2 Computer Security Incident Response Team (CSIRT) Structure and Staffing NISTSP61-3 Preparation: Communications, Toolkits, Training, Exercises, Threat Intelligence NISTSP63R4-1 Digital Identity Risk Management and IAL/AAL/FAL Assurance Level Selection NISTSP63R4-5 Federation: Assertions, Trust Agreements, RP Validation, Pseudonymous Identifiers NISTSP88-1 Media Sanitization Policy, Roles, and Decision Framework NISTSP88-4 Cryptographic Erase, Key Management, and Verification of Erase NJDPA-7 Data Protection Assessments and Processor Contracts NJDPA-8 AG Platkin Enforcement, 18-Month Cure Sunset, and Division of Consumer Affairs NGNDPR-5 Security of Personal Data, Breach Notification, and DPIA under NDPR Section 2.6-Security NGNDPR-6 Data Protection Officer, DPCOs, and Processor Obligations OSFIB13-1 Governance, Risk Management, and Three Lines of Defense OSFIB13-3 Cyber Security: Identification, Protection, Detection, Response, Recovery OWASPSAMM-1 Governance: Strategy, Policy, Compliance, Education, Champions OWASPSAMM-2 Design: Threat Assessment, Security Requirements, Security Architecture OPENBANK-2 Strong Customer Authentication (SCA), Consent Lifecycle, and Customer UX OPENBANK-3 Mutual TLS, Token Binding, Request Signing (JWS), Key Management OSSFSC-1 Branch Protection, Code Review, and Repository Governance OSSFSC-6 Signed Releases, Provenance, Trusted Publishing, Binary Artifacts PCI-P2PE-05 Roles and responsibilities definition PCI-P2PE-09 Encryption and key management PCI-PIN-05 Roles and responsibilities definition PCI-PIN-09 Encryption and key management PCI-SSF-05 Roles and responsibilities definition PCI-SSF-09 Encryption and key management PSDTWO-1 Strong Customer Authentication (SCA) Core Requirements PSDTWO-2 SCA Exemptions and Risk-Based Authentication PERU-3 Data Subject Rights (ARCO), Habeas Data, Automated Decisions PERU-7 DPO, Records, Retention, Marketing, Training QATAR-5 Security of Processing QATAR-7 DPO, Records, Retention, Marketing, Training PICERL-P2 Risk Assessment PICERL-P3 CSIRT Formation SHAREASSESS-1 Information Governance and Risk SHAREASSESS-3 Network Security, Endpoint, Data Protection SUPCHAIN-1 Build Integrity - Source, Build, Provenance SUPCHAIN-2 Source Integrity - Branch Protection, Code Review, Two-Person Rule SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17) SOC2-CC7.4 CC7.4 Responding to security incidents SSAE18-CC7.4 CC7.4 - Incident Response SSAE18-PI1.1 PI1.1 - Processing Integrity Definition C1 Organizational Boundary C3 Scope 1 and 2 Coverage CISABD-1 Take Ownership of Customer Security Outcomes SBD-DEV-04 Phishing-Resistant Authentication ISMSP-SYS-02 Encryption Implementation ISMSP-SYS-04 Vulnerability Management KISO-1.3 Definitions KISO-4.1 User data protection PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37 SWE-1 Scope and Purpose SWE-2 Relationship to GDPR TAIWAN-2 Consent, Notice, Sensitive Data TAIWAN-3 Data Subject Rights TANZANIA-1 Scope, Registration, Lawful Basis TANZANIA-4 Security and Cross-Border TEXASTDPSA-2 Consumer Rights TEXASTDPSA-3 Sensitive Data, Children, Sale Notice Standard 15 Online Tools Standard 2 Data Protection Impact Assessments UKGAMBLE-1 Scope and Applicability to Licensees UKGAMBLE-4 Resilience and Incident Response US-ITAR-EAR-DS-01 Technical Data Protection US-ITAR-EAR-DS-02 Cloud and Storage US-SEC-DA-SC-01 Howey Test Application US-SEC-DA-SC-02 Registration Requirements VIETNAMPDP-2 Consent and Notice VIETNAMPDP-3 Data Subject Rights VIRGINIAVCDPA-2 Consumer Rights VIRGINIAVCDPA-3 Sensitive Data Consent and Children CFR211-A-3 Section 211.3 - Definitions APPI-A34 Request for Correction, Addition or Deletion 4.4.1 Resources, Roles, Responsibility, and Authority BSI-08 Cryptographic protection of data COBIT-BAI02 Managed requirements definition CA-9 Internal System Connections CA-9 Internal System Connections Sapin2-Pillar1-Code-of-Conduct Pillar 1 - Anti-Corruption Code of Conduct ICP-1 Objectives, Powers and Responsibilities of the Supervisor IATA-IOSA-Section1-ORG-Organization-ManagementSystem-SMS IATA IOSA Section 1 - ORG Organization and Management System + Safety Management System (SMS) + Safety Policy + Hazard ID + Quality ISO-14064-1-5.1 Organizational boundaries ISO-26000-6.7 Consumer issues ISO-26262-3-5 Item definition ISO28001-PI-01 Personnel Security Screening ISO27003-4.3 Determining the scope of the information security management system 27007-5.2 Audit Programme Objectives 27010-10.1 Cryptographic Protection 27050-1.4 Terms and definitions 29134-3 Terms and definitions BIPA-SEC5-1 Biometric Identifier Definition NISTSP66-6 Technical Safeguards: Access Control, Audit Controls, Integrity, Person Authentication NRFCS-1 Retail Cybersecurity Governance, Policy, and Regulatory Change Management NGCB-7 Patron and Employee Data Protection + Data Inventory + Vendor Management NZISM-3 Personnel Security, Physical Security, and Cryptography NGOB-3 API Security Standards, mTLS, and Encryption AUNDB-A3 Eligible Data Breach Determination and Serious Harm Threshold OECDAI-5 Data Governance, Training Data Quality, Privacy, and Bias Mitigation OMANCS-4 Data Protection, Cryptography, and Privacy Alignment PASONE-4 Technical Security: CDE Configuration, BIM Tools, Encryption, Aggregation, Mobile Working 2.2.2 2.2.2 Vendor default accounts managed PARAGUAY-5 Security of Processing, Data Integrity, Information Security PHILCC-1 Computer Crime Offences (Illegal Access, Interference, Misuse of Devices) RCEPEC-1 Online Personal Information Protection (12.13) RIDTPPA-1 Scope, Applicability, Definitions SOC-CY-C2 Encryption and Data Protection SCA-S2 Interpretation and Definitions STUDPRV-2 Data Subject Rights for Students and Parents TEF-2 Openness and Transparency TSSR-INFO-1 Network Data Protection UKAI-2 Sector-Specific Regulator Engagement D.1 Incident Response Planning UK-TSA-NET-01 Security Architecture UNESCOAI-2 Principles 4-7: Sustainability, Privacy, Human Oversight, Transparency UNICEFAI-4 Transparency, Explanation, Adult Capacity CPSC-CS.3 Data Protection for Safety Systems 15 U.S.C. § 78dd-2(h) Definition of Domestic Concern WCAGREC-3 Principle 3: Understandable SO2.2 Digital health architecture blueprint Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in Mobile Device Policies Query this from an agent The graph holds this control, the 543 it maps to, and the evidence behind each claim, over MCP and REST.