Phones and tablets hold email, chat, customer data and often authentication apps. AC-19 asks you to set rules for them. Establish configuration requirements, connection requirements and implementation guidance for organization controlled mobile devices, including when they are outside controlled areas, and authorize their connection to your systems.
SP 800-53 binds US federal systems and, through contract, other organizations. For a private company it is a reference, and mobile device questions appear in most customer security reviews.
What it means in practice
The guidance defines a mobile device as small enough for one person to carry, built to run without a physical connection, with local storage and its own power. Smartphones and tablets are the examples. Because these devices travel, protection is partly about behavior, and users must take physical steps to protect them outside controlled areas. Controlled areas are spaces where you provide physical or procedural controls.
Restrictions vary by device class, since capabilities differ. The guidance mentions configuration management, device identification and authentication, and related measures.
Enhancements: AC-19.1 Use of Writable and Portable Storage Devices, AC-19.2 Use of Personally Owned Portable Storage Devices, AC-19.3 Use of Portable Storage Devices with No Identifiable Owner, AC-19.4 Restrictions for Classified Information and AC-19.5 Full Device or Container based Encryption. For most commercial teams, AC-19.5 is the one that matters: encrypt the whole device or a managed container.
Evidence to collect
- A mobile device policy covering ownership models, such as company owned and personally owned with management.
- Mobile device management enrollment records and the compliance rules applied.
- Settings showing encryption, passcode strength and remote wipe.
- A device inventory with owners.
- Authorization records for which devices may reach corporate email and systems.
- Offboarding evidence showing devices wiped or unenrolled.
Common gaps
- Personal phones reading company email with no management at all.
- No remote wipe, or a wipe never tested.
- Devices left enrolled after the owner has left.
- Jailbroken or outdated devices still allowed to connect.
- Policy that covers phones but ignores tablets.
How to implement it
Choose a model: company owned devices, or personal devices enrolled in a managed container. Use MDM to require a passcode, encryption and a supported operating system version. Block access from devices that fall out of compliance.
Test remote wipe once a year. Include devices in your offboarding checklist. Then keep an inventory, since an auditor will ask how many devices connect and which of them are managed.
Quick check
Why is mobile protection partly behavioral?
Because users must take physical action to protect devices outside controlled areas, according to the guidance.
Which enhancement covers encryption?
AC-19.5 Full Device or Container based Encryption.
Sources
- NIST SP 800-53 Rev 5, AC-19: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-19
- NIST OSCAL catalog of SP 800-53 Rev 5: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json
