[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fac-19":3},{"item":4,"lessons":18,"controls":64,"related":92},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ac-19","AC-19","Access Control for Mobile Devices",11,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must establish configuration, connection and implementation requirements for organisation-controlled mobile devices, including when outside controlled areas, and authorise the connection of mobile devices to its systems.\n\n**In practice.** Doing this well means mobile device management or application management with enforced passcodes, encryption, OS version requirements and remote wipe, plus conditional access that only lets compliant devices reach corporate data. Auditors look for MDM policies, compliance reports and conditional access rules. CIS Controls 4 and 6 include related mobile safeguards. Lost or stolen devices should be wiped promptly, following a reported procedure.\n\n**Common gaps.** Personal phones often access email and files with no management at all. Compliance policies that only report rather than block give a false sense of control. Outdated mobile operating systems also stay connected long after support ends.","a. Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas; and\n  b. Authorize the connection of mobile devices to organizational systems.\nDiscussion: A mobile device is a computing device that has a small form factor such that it can easily be carried by a single individual; is designed to operate without a physical connection; possesses local, non-removable or removable data storage; and includes a self-contained power source. Mobile device functionality may also include voice communication capabilities, on-board sensors that allow the device to capture information, and\u002For built-in features for synchronizing local data with remote locations. Examples include smart phones and tablets. Mobile devices are typically associated with a single individual. The processing, storage, and transmission capability of the mobile device may be comparable to or merely a subset of notebook\u002Fdesktop systems, depending on the nature and intended purpose of the device. Protection and control of mobile devices is behavior or policy-based and requires users to take physical action to protect and control such devices when outside of controlled areas. Controlled areas are spaces for which organizations provide physical or procedural controls to meet the requirements established for protecting information and systems.\n\nDue to the large variety of mobile devices with different characteristics and capabilities, organizational restrictions may vary for the different classes or types of such devices. Usage restrictions and specific implementation guidance for mobile devices include configuration management, device identification and authentication, implementation of mandatory protective software, scanning devices for malicious code, updating virus protection software, scanning for critical software updates and patches, conducting primary operating system (and possibly other resident software) integrity checks, and disabling unnecessary hardware.\n\nUsage restrictions and authorization to connect may vary among organizational systems. For example, the organization may authorize the connection of mobile devices to its network and impose a set of usage restrictions, while a system owner may withhold authorization for mobile device connection to specific applications or impose additional usage restrictions before allowing mobile device connections to a system. Adequate security for mobile devices goes beyond the requirements specified in [AC-19](#ac-19) . Many safeguards for mobile devices are reflected in other controls. [AC-20](#ac-20) addresses mobile devices that are not organization-controlled.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60],{"slug":21,"title":22,"published_at":23},"android-malware-combines-ransomware-spyware-via-sideloaded-apks","Android Malware Combines Ransomware & Spyware via Sideloaded APKs","2026-09-10T22:20:24.409+00:00",{"slug":25,"title":26,"published_at":27},"russian-hackers-target-eu-officials-via-encrypted-messaging-apps","Russian Hackers Target EU Officials via Encrypted Messaging Apps","2026-08-27T12:20:46.665+00:00",{"slug":29,"title":30,"published_at":31},"stolen-laptop-exposes-personal-data-resulting-in-dual-fines-for-polish-controller-and-processor","Stolen Laptop Exposes Personal Data, Resulting in Dual Fines for Polish Controller and Processor","2026-08-05T08:20:55.861+00:00",{"slug":33,"title":34,"published_at":35},"pegasus-spyware-compromises-eu-parliament-investigators-iphone","Pegasus Spyware Compromises EU Parliament Investigator's iPhone","2026-07-03T06:20:45.206+00:00",{"slug":37,"title":38,"published_at":39},"cellebrite-tools-used-against-russian-activist-despite-sales-ban","Cellebrite Tools Used Against Russian Activist Despite Sales Ban","2026-06-26T10:21:01.101+00:00",{"slug":41,"title":42,"published_at":43},"usb-spread-clipboard-hijacker-silently-redirects-crypto-transactions","USB-Spread Clipboard Hijacker Silently Redirects Crypto Transactions","2026-06-23T15:22:02.31+00:00",{"slug":45,"title":46,"published_at":47},"usb-worm-hijacks-crypto-wallets-via-windows-shortcut-files","USB Worm Hijacks Crypto Wallets via Windows Shortcut Files","2026-06-18T18:21:07.648+00:00",{"slug":49,"title":50,"published_at":51},"crypto-clipper-malware-spreads-via-usb-with-tor-based-c2-and-worm-propagation","Crypto Clipper Malware Spreads via USB with Tor-Based C2 and Worm Propagation","2026-06-18T02:20:23.987+00:00",{"slug":53,"title":54,"published_at":55},"mobile-malware-toolkit-targets-android-and-ios-devices","Mobile Malware Toolkit Targets Android and iOS Devices","2026-04-25T05:09:50.374+00:00",{"slug":57,"title":58,"published_at":59},"android-banking-trojan-source-code-release-threatens-mobile-security","Android Banking Trojan Source Code Release Threatens Mobile Security","2026-04-19T19:08:29.031+00:00",{"slug":61,"title":62,"published_at":63},"device-code-phishing-exploits-legitimate-authentication-flows","Device Code Phishing Exploits Legitimate Authentication Flows","2026-04-17T22:08:22.706+00:00",[65,70,74,79,84,88],{"slug":66,"name":67,"problem":68,"stories":69},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",5,{"slug":71,"name":72,"problem":73,"stories":69},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":75,"name":76,"problem":77,"stories":78},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",4,{"slug":80,"name":81,"problem":82,"stories":83},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",2,{"slug":85,"name":86,"problem":87,"stories":83},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":89,"name":90,"problem":91,"stories":83},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[93,99,104,109,113,117,121,125],{"family":94,"item":95,"code":96,"title":97,"together":98},"cis","4","Control 4","Secure Configuration of Enterprise Assets and Software",6,{"family":100,"item":101,"code":102,"title":103,"together":98},"nist-sp","800-124","SP 800-124","SP 800-124 Rev. 2: Guidelines for Managing the Security of Mobile Devices in the Enterprise",{"family":105,"item":106,"code":107,"title":108,"together":98},"gdpr","32","Article 32","Security of processing",{"family":5,"item":110,"code":111,"title":112,"together":69},"si-3","SI-3","Malicious Code Protection",{"family":114,"item":115,"code":116,"title":116,"together":69},"itil","overview","ITIL",{"family":94,"item":118,"code":119,"title":120,"together":69},"14","Control 14","Security Awareness and Skills Training",{"family":94,"item":122,"code":123,"title":124,"together":78},"2","Control 2","Inventory and Control of Software Assets",{"family":94,"item":126,"code":127,"title":128,"together":78},"6","Control 6","Access Control Management"]