What it covers. NIST guidance on securing smartphones and tablets used for work, whether organisation-owned or personally owned. It describes mobile threats and the technologies available to manage them, such as enterprise mobility management, mobile threat defence and application vetting.
In practice. Applying it well means defining which devices and deployment models are allowed, enrolling devices in management, and enforcing baseline settings such as screen lock, encryption and current operating system versions. Organisations separate work data from personal data where devices are personally owned and can wipe work data on loss. Evidence includes a mobile policy, enrolment statistics, compliance reports and processes for lost devices.
Common gaps. Typical gaps are unmanaged personal devices accessing email and files, outdated operating systems that can no longer be patched, and no control over risky apps.