Does your business have agreed rules for phones used for work, including personal phones? 1. Does your business have agreed rules for phones used for work, including personal phones?
No, everyone uses their phones however they like. We have informal guidance, but it is not written down or agreed by staff. We have a short written BYOD agreement that staff accept before work data goes on their phone.
If a phone with work access is lost tonight, would staff know who to tell and what happens next? 2. If a phone with work access is lost tonight, would staff know who to tell and what happens next?
Probably not. They might wait or try to handle it alone. They would tell someone, but the steps are not clear. Yes. There is a named contact, a short checklist and a rule to report within the hour without blame.
How well are business and personal data separated on staff phones? 3. How well are business and personal data separated on staff phones?
Not at all. Work chats, files and photos are mixed with personal ones. Some separation, such as a business chat account, but files are still mixed. Work apps and data sit in work profiles or approved apps, so they can be removed without touching personal data.
When someone leaves the business, what happens to work data on their phone? 4. When someone leaves the business, what happens to work data on their phone?
Nothing specific. Their access often continues. We remove some accounts, but there is no checklist. We follow an exit checklist to remove work apps, revoke sessions and confirm business data is off the device.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered