BYOD: The elements of getting it right the first time

Bring-your-own-device, or “BYOD” as it is commonly known throughout the federal IT community, promises greater productivity, lower costs and greater worker satisfaction. IT leaders must balance the perceived benefits of BYOD with existing requirements in addition to new challenges and requirements that often extend beyond traditional agency IT deployments. New devices, capabilities, and use cases have caused agencies to reconsider typical deployments of mobile devices that in the past centered primarily on BlackBerry services.

The Office of Management and Budget reminded agencies on Sept. 27, 2012, that the Federal Information Security Management Act and all other federal information security, privacy and records retention requirements apply to mobile devices:

"All existing federal requirements for data protection and remote access are applicable to mobile devices. For example, the security requirements in OMB Circular A-130, [the National Institute of Standards and Technology’s] FIPS 140-2, Security Requirements for Cryptographic Modules, NIST FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, and NIST FIPS 200, Minimum Security Requirements for Federal Information and Information Systems, apply (including appropriate security controls specified in NIST SP 800-53).

"Agencies should specify security requirements during the acquisition process and ensure that procurements capture the requirements of the Federal Acquisition Regulation (e.g. 52.225-5, Trade Agreements), OMB policy (e.g. M-06-16 and M-07-16), and NIST standards and guidelines. Additional guidance regarding the use and management of mobile devices will be developed as appropriate."

Traditional requirements
Understanding the requirements in that statement will be crucial for agencies that wish to successfully deploy BYOD capabilities. The main areas of focus for OMB were whole-device encryption and mobile device management capabilities. Mobile device encryption is explained in OMB M-06-16 and can be summarized as ensuring the full device is encrypted using FIPS 140-2 validated encryption, that multifactor authentication is used and, finally, that all requirements of FISMA and NIST are met.

The requirements of FISMA are most often met through the functions provided by Mobile Device Management. MDM solutions often include but are not limited to: user administration, geo-location services, remote lock services, remote wipe services, application installation, removal, and update capabilities, records retention, eDiscovery, legal hold, and FOIA search and preserve capability.

At a high level, these functions map back to the requirements of FIPS-200  and NIST Special Publication 800-53. Without these functions, a solution would likely not be considered compliant with FISMA and would most likely expose the agency to breaches or compromise. The existing requirements for mobile devices should form the foundation of an agency's BYOD deployment.

New requirements
BYOD presents numerous new requirements from technological, cultural and managerial perspectives. The CIO Council published a BYOD toolbox  that explains some of the new requirements:

• Incentives for government and individuals.


• Survey employees on benefits and challenges.


• Consider voluntary vs. mandatory participation in BYOD program and impacts on terms of service.


• Education, use, and operation:
• Establish orientation, training and user agreements.
• Establish associated policies collaboratively with a union representative.
• Ensure compliance with Fair Labor Standards Act (FLSA) requirements (for example, institute policies to ensure non-exempt employees do not conduct work after hours unless directly authorized and instructed).
• Consider the impact of connectivity and data plan needs for a chosen technical approach (such as virtualization) on employee reimbursement.
• Implement telework agreements consistent with the Telework Enhancement Act and OMB implementation requirements.


• Privacy:
• Identify the right balance between personal privacy and organizational security.
• Document the process for employees to safeguard personal data if/when government wipes the device.


• Ethics / legal questions:
• Define “acceptable use” from both government and individual perspective.
• Address legal discovery (including confiscation rights) and liability issues (for example, through pre-defined opt-in requirements in terms of service).
• Consider implications for equal rights employment (for example, the disparity in quality of personal devices).

These new requirements entail a multi-disciplinary implementation approach from agencies to ensure they do not violate employee rights or agreements. From the CIO’s perspective, a BYOD deployment will be different from any other IT project. A successful deployment will require bringing several organizational groups to the IT table that may normally not be present.

Finance and budget personnel need to be involved to ensure BYOD actually saves the agency money and is consistent with an agency's budget authority. Costs associated with increased complexity, help desk support, multiple devices and OS support must be considered. Many budget officers will also cite concerns surrounding budget augmentation that should be determined in writing with the aid of legal counsel. Finally, the agency must determine what, if any, re-imbursement an employee or contractor is entitled to receive. The results from the budget office could tip the scales towards or away from BYOD deployment.

In addition to reviewing concerns about financial augmentation and employee reimbursement, legal counsel should be involved in several areas. Agencies must determine what impact BYOD may have concerning existing labor bargaining agreements. They must also determine what privacy rights the employee or contractor is entitled to under the Privacy Act and how those rights should be protected. Finally, legal counsel must address e-discovery, FOIA, and legal hold considerations. In many cases, a legal hold may involve copying, seizing or imaging a complete personal mobile device.

Handling device proliferation
CIOs operating a single device, single operating system, and single carrier mobile device program also have a challenge in ensuring a multitude of new devices, manufacturers, carriers, operating systems, and operation modes are supported in their infrastructure when they transition to BYOD. This additional complexity can quickly increase the cost of implementing a BYOD program. As noted in the CIO Council’s toolbox, a careful survey of the employee and contactor population can provide the CIO with a measure of organizational interest and some information about the devices used by an agency's workforce.

It is also important to consider the interaction between BYOD and “Cloud First”  initiatives the agency may have under way. Many agencies are adopting cloud e-mail solutions with integrated document sharing and collaboration environments. Data loss prevention mechanisms in cloud environments may be quite different from those that protect the on-premises network, and this can present security challenges when a heterogeneous array of enrolled devices are allowed access.

Through careful collaboration, research, and secure implementation, BYOD promises greater employee satisfaction and cost savings for the agencies. CIOs must fully understand not only new requirements, but also existing requirements to ensure a BYOD deployment would not expand costs or increase an agency's security and privacy exposure.