BRING-YOUR-OWN-MOBILE-DEVICE-MANAGEMENT---A1613.PDF

MARICOPA COUNTY INTERNAL POLICY
Policy Title: Policy Number: A1613
BRING YOUR OWN MOBILE DEVICE
Current Adoption
MANAGEMENT Date: 05-22-2013
Board Agenda
C-41-13-009-6-00
Approved by: Number:
BOARD OF SUPERVISORS Original Adoption
12-12-2012
Date:
I. PURPOSE
The intent of this policy is to: reduce the number of County-owned Mobile Devices
(e.g., cellular phones and other portable devices), allow employees to carry only one
device as opposed to one personal and one County-owned, and reduce the per-
device costs to the County. This policy also aims to create new opportunities for
business enablement and to improve employee efficiency.
II. AUTHORITY
This Policy is authorized by the Board of Supervisors pursuant to A.R.S. 11-251.
III. APPLICATION AND ENFORCEMENT
This Policy applies to Employees of all County departments whose Appointing
Authority chooses to participate in the program.
IV. DEFINITIONS
A. Application Store: A Web site for downloading applications from authorized
third-party developers. It is accessible from the Mobile Device and may be
integrated with associated desktop applications (in addition to applications
acquired from an Application Store, both Enterprise and line-of-business
applications can be developed to meet business needs of the County).
B. Appointing Authority: An elected official, the single administrative or executive
head of a Department, or the designated representative authorized to act in this
capacity.
C. Authorized BYOD User (Authorized User): An Employee that desires to
participate in the BYOD program, applies to participate, is approved by the
Appointing Authority, and meets this P a personally-owned
Mobile Device .
1 of 6

Policy Title: Policy Number: A1613
BRING YOUR OWN MOBILE DEVICE
Current Adoption
MANAGEMENT Date: 05-22-2013
D. Bring Your Own Device (BYOD): A model whereby an Authorized User
employs a personally-owned Mobile Device to conduct County business and for
which they may receive a stipend for cellular voice and/or data service.
E. BYOD Mobile Device: Employee-owned Mobile Devices that are capable of
using cellular services to access the County network.
F. Department: A department is a division of the County (e.g., Office of Finance,
Office of Enterprise Technology, Facilities Management Department, etc.) and
includes Special Districts which are the Flood Control District of Maricopa
County, Maricopa County Library District and Stadium District.
G. Encryption: The process of making data undecipherable without the appropriate
decryption key. Encryption algorithms and security functions used for compliance
with this Policy shall, at a minimum, meet the standards set forth by the National
Institute of Science and Technology (NIST) in the Federal Information Processing
Standard (FIPS) publication 140-2; however, it is not required that each individual
cryptographic implementation be FIPS validated to achieve compliance with this
policy.
H. Stipend:
time/services on their personal cellular/digital usage plan as follows:
a. Voice only - $10 per month
b. Voice/Data - $30 per month
I. Storage Medium: A device used to store data. Examples include a computer
ve .
V. POLICY
A. General Policy Statements
1. Employee participation in the BYOD program is optional at all times, subject
to approval by the Appointing Authority. Additionally, whether to use a
County-owned or personally-owned device is solely the option of the
employee.
2. Appointing Authorities shall determine e need for a mobile device
as well as the employ eligibility to participate in the BYOD program.
Employees not meeting the criteria of policy A1612 Mobile Device Usage
are ineligible to participate in the BYOD program.
Page 2 of 6

Policy Title: Policy Number: A1613
BRING YOUR OWN MOBILE DEVICE
Current Adoption
MANAGEMENT Date: 05-22-2013
3. The County will respect the privacy of BYOD Mobile Devices and will only
request access to the BYOD Mobile Device to implement security controls or
in regard to administrative, civil, or criminal proceedings or in response to a
public records request or discovery request.
4. Use of a BYOD does not subject all records of use to disclosure under public
records law. Purely personal use conducted on a participating BYOD Mobile
Device is not subject to disclosure pursuant to a public records request.
However, if a public record request or discovery request is made for County
records maintained on a BYOD, the Authorized BYOD User must not delete
any data after receiving notice of the request and must immediately provide
the device to their supporting IT department. The supporting IT department
may access the BYOD device and all records and data on the BYOD device
will be reviewed to determine what records and data may be released in
response to the records request or discovery request.
5. Data Preservation Requirements:
a. Authorized BYOD Users shall assist in the protection of County data at
all times.
b. Authorized BYOD Users of Mobile Devices must preserve all data in
accordance with applicable retention schedules, public records
requirements, and Department procedures on the Mobile Device that is
not a duplicate of information stored on County IT systems (e.g. text
messages, photos, Mobile Device created documents, etc.)
c. The Authorized BYOD User is responsible for backing up information
on their Mobile Device. Wherever possible, the backup shall be
encrypted with a password that meets the minimum acceptable
requirements established by the employee s information technology
department.
d. Authorized BYOD Users shall not download or transfer proprietary and
confidential information to a BYOD Mobile Device without approval
from the Appointing Authority. IT departments providing device support
shall provide the Appointing Authority and Authorized BYOD User with
information regarding the controls in place to protect proprietary and
confidential information on the device. This excludes County e-mail
that is protected through other security controls.
e. Authorized BYOD Users shall not move County data from a BYOD
Mobile Device to an unprotected device or Storage Medium, unless
such movement is approved by Department procedure.
6. Additional Authorized BYOD User Requirements:
Page 3 of 6

Policy Title: Policy Number: A1613
BRING YOUR OWN MOBILE DEVICE
Current Adoption
MANAGEMENT Date: 05-22-2013
a. Authorized BYOD User will password protect the BYOD Mobile Device;
b. Authorized BYOD User agrees to maintain the
original operating system and keep it current with security patches and
updates, as released by the manufacturer.
c. Authorized BYOD U nstalling
software that allows the user to bypass standard built-in security
features and controls).
d. Authorized BYOD User agrees that the BYOD Device will not be
shared with other individuals or family members, due to the business
use of the device (potential access to County records, e-mail, etc.).
e. Authorized BYOD Users that are Non-Exempt Employees are
prohibited from using any Mobile Device for County business unless
system. Non-exempt employees must follow all relevant County
policies regarding on-call/overtime. See Policy B7006: Hours Worked
and Overtime Policy.
f. Authorized BYOD Users must comply with all County policies,
including but not limited to, Policy A1609: Acceptable Use of County
Technology Resources when using a BYOD Device in performance of
their duties to the County.
g. Authorized BYOD Users receiving a Stipend must immediately inform
the County upon suspension or termination of service.
h. Authorized BYOD Users are responsible for any costs incurred for
items employee purchased on the BYOD Mobile Device for personal
purposes from an Application Store.
i. Authorized BYOD Users shall obtain Appointing Authority approval in
writing prior to purchasing any item from an Application Store on the
BYOD Mobile Device for County purposes. Authorized BYOD User
may be reimbursed by the County for the item purchased.
j. Authorized BYOD Users must ensure that their cellular/data service
plan for the BYOD Mobile Device is compatible with their usage of the
device for County business.
Page 4 of 6

Policy Title: Policy Number: A1613
BRING YOUR OWN MOBILE DEVICE
Current Adoption
MANAGEMENT Date: 05-22-2013
7. The County reserves the right to audit Authorized BYOD Users for
continuance of service and proof of payment of their BYOD Mobile Device
cellular/data service plan so long as they receive a Stipend.
8. The County shall not pay any costs incurred by the Authorized BYOD User as
a result of fees, device replacement, overages, or any other additional or
unexpected costs.
9. The Authorized BYOD User, by signing a standard form provided by the
ile device IT provider, shall consent to:
a. Acknowledge and abide by all of the requirements contained in this
Policy.
b. Allow the County to erase any and all data, County and personal, on
the BYOD Mobile Device in the event the device is lost, stolen, or the
the County is terminated. To that effect, it is
the responsibility of the Authorized BYOD User to regularly backup
their personal data.
c. Allow the County to inspect the BYOD Mobile Device if reasonable
cause exists to believe the device has been subject to a security
compromise.
d. Acknowledge that in the course of removing County data from the
BYOD Mobile Device all data, County and personal, might be
unrecoverable.
e. Release Maricopa County from all liability should the BYOD Mobile
Device be damaged by County support personnel or software provided
by the County.
f. Release Maricopa County from all liability from any loss of personal
data stored on a BYOD Mobile Device.
g. Acknowledge that the County shall not be financially responsible for
any costs incurred above and beyond the Stipend provided.
B. Device Security and Support
1. If a Mobile Device is lost or stolen, the Authorized User shall contact their
information technology help desk immediately or as soon as
practicable.
Page 5 of 6

Policy Title: Policy Number: A1613
BRING YOUR OWN MOBILE DEVICE
Current Adoption
MANAGEMENT Date: 05-22-2013
2. The County shall provide any software agents required for proper, secure
access to County systems free of charge to Authorized Users using
personally-owned devices.
3. The password and Encryption keys used on Mobile Devices shall meet the
minimum standards set by the Office of Enterprise Technology (OET).
Elected Offices may supersede the OET password and Encryption standards
at the discretion of the Elected Office's Appointing Authority.
4. County data must be encrypted when stored on any Mobile Device.
C. Responsibility
Department PC/LAN teams are responsible for basic troubleshooting of Mobile
Devices and for working with the mobile device IT provider to complete agent
deployment and advanced troubleshooting.
Page 6 of 6