What it covers. NIST guidance on establishing a process to vet mobile applications before organisations approve them for use. It describes defining security requirements for apps, testing them and making approval decisions. It is aimed at organisations that deploy mobile apps to staff, whether built in-house or obtained from third parties.
In practice. Organisations define which app behaviours are unacceptable, such as excessive permissions or insecure data storage, test apps using automated tools and analysts, and record approval decisions. Approved apps are distributed through managed channels and reassessed when updated. Evidence includes vetting criteria, test reports and an approved app list.
Common gaps. Typical gaps are no vetting for apps installed on managed devices and approvals that are not revisited after updates. Apps developed in-house are also sometimes exempted from vetting.