Page 635 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

congestion and interference. A mobile device policy needs to be
considered in light of the additional infrastructure costs it will trigger.

Legal Concerns
Company attorneys should evaluate the legal concerns of mobile

devices. Using personal devices in the execution of business tasks
probably means an increased burden of liability and risk of data
leakage. Mobile devices may make employees happy, but it might not
be a worthwhile or cost-effective endeavor for the organization.

Acceptable Use Policy

The mobile device policy should either reference the company
acceptable use policy or include a mobile device–specific version

focusing on unique issues. With the use of personal mobile devices at
work, there is an increased risk of information disclosure, distraction,
and access of inappropriate content. Workers should remain mindful
that the primary goal when at work is to accomplish productivity tasks.

On-board Camera/Video

The mobile device policy needs to address mobile devices with on-
board cameras. Some environments disallow cameras of any type. This
would require that mobile devices be without a camera. If cameras are

allowed, a description of when they may and may not be used should
be clearly documented and explained to workers. A mobile device can
act as a storage device, provide an alternate wireless connection
pathway to an outside provider or service, and also be used to collect
images and video that disclose confidential information or equipment.