2. Confidentiality of enterprise mobile applications and data (e.g. email, messages, files) are protected as follows (select all that apply):

a. Data-at-rest full disk, container, or equivalent encryption is required for all enterprise mobile resources

b. Access to enterprise resources such as e-mail and intranet requires a VPN or equivalent managed secure connection

c. Enterprise administrators have the ability to remotely block access to or wipe enterprise data when the mobile device can no longer be trusted

d. None apply

3. Enterprise mobile access is controlled by (select all that apply):

a. Strong single-factor authentication (e.g. complex password) of user to device

b. Strong single-factor authentication of user to enterprise apps/resources

c. Dual-factor authentication for extra-sensitive enterprise apps/resources

d. None apply

6. Mobile device lifecycle is managed as follows (select all that apply):

a. Deployment models and the use cases that drive them are managed by a formally documented policy

b. The supported device types and operating system versions and patches are managed by a formally documented policy

c. The process for provisioning new devices is managed by a formally documented policy

d. The process for de-provisioning/recycling of devices is managed by a formally documented policy

e. None apply

7. Enterprise mobile applications in use include (select all that apply):

a. PIM suite (e-mail, contacts, calendar)

b. Work applications available from app stores and SaaS providers, such as CRM, document management, and HR

c. Bespoke/custom applications developed by third party contractors and/or internal developers

d. None apply

8. Mobile applications, systems, and access are assessed for vulnerabilities (including penetration tested) as follows (select all that apply):

a. Rarely/never: we rely on safe use policies and trustworthy vendors and systems

b. Regularly, by internal assessment/testing teams

c. Regularly, by external professional assessment/testing organizations

d. None apply

9. Mobile security practices and policies are managed by an information technology and security team that consists of (select all that apply):

a. CIO or equivalent top level IT executive

b. CISO or equivalent IT security executive, reporting to and distinct from CIO

c. Head of mobile/endpoint security, reporting to and distinct from CISO

d. None apply

10. The following mobile risk management processes and programs are followed (select all that apply):

a. Threat modeling is performed regularly to identify and respond to emerging risks from mobile-borne sources

b. Risk assessments are performed regularly, follow industry recognized frameworks, and include mobile environments

c. HR and legal departments regularly review mobile policies for acceptable use, compliance, liability, and insurance purposes

d. Employees are regularly trained on proper mobile use and security awareness

e. Organization has a formalized security incident response program that covers the organization’s mobile devices, users, apps, and infrastructures

f. None apply