3
★ ★
Introduction
The Digital Government Strategy (the Strategy) (PDF/HTML), issued by Federal Chief Information Ocer
(CIO) Steven VanRoekel on May 23, 2012, called for the establishment of a Digital Services Advisory
Group (Advisory Group) to promote cross-agency sharing and accelerated adoption of mobile workforce
solutions and best practices in the development and delivery of digital services. Milestone Action #3.3
of the Strategy requires the Advisory Group to work with the Federal CIO Council (CIOC) to develop
government-wide bring-your-own-device (BYOD) guidance based on lessons learned from successful
BYOD programs launched at forward-leaning agencies. Through the BYOD Working Group, the Advisory
Group and CIOC produced this document to fulll the requirements of Milestone Action #3.3.
Implementing a BYOD program is not mandatory. This document is intended to serve as a toolkit for
agencies contemplating implementation of BYOD programs. The toolkit is not meant to be comprehen-
sive, but rather provides key areas for consideration and examples of existing policies and best practices.
In addition to providing an overview of considerations for implementing BYOD, the BYOD Working Group
members developed a small collection of case studies to highlight the successful eorts of BYOD pilots
or programs at several government agencies. The Working Group also assembled examples of existing
policies to help inform IT leaders who are planning to develop BYOD programs for their organizations.
Future Digital Government Strategy deliverables, such as the Mobile Security Reference Architecture
encompassed in Milestone Action #9.1, will help inform agency considerations on BYOD. The National
Institute of Standards and Technology (NIST) is also drafting several standards and guidelines focused on
mobility, including: Guidelines for Managing and Securing Mobile Devices in the Enterprise; Security and
Privacy Controls for Federal Information Systems and Organizations; and Personal Identity Verication
(PIV) of Federal Employees and Contractors. Each of these documents should provide further insight
into issues associated with the implementation of BYOD solutions.
While the case studies and example policies that the BYOD Working Group has assembled are a
great starting point for agencies considering BYOD programs, this work is not nished. The Federal
Government still has more to do to address the more complicated issues related to BYOD. This includes
how the government can reimburse Federal employees for voice/data costs incurred when they use
their personal mobile devices instead of government-issued mobile devices, and additional security,
privacy, and legal considerations including supply chain risk management and legal discovery.
1. BYOD is a concept that allows employees to utilize their personally-owned technology devices to stay connected
to, access data from, or complete tasks for their organizations. At a minimum, BYOD programs allow users to access
employer-provided services and/or data on their personal tablets/eReaders, smartphones, and other devices. This
could include laptop/desktop computers; however, since mature solutions for securing and supporting such devices
already exist, this document focuses on the emerging use case of mobile devices.
2. NIST SP 800-124 Revision 1 (Draft), Guidelines for Managing and Securing Mobile Devices in the Enterprise was
released for comment on July 10th, 2012, and includes recommendations for securing personally-owned mobile
devices. Later this year, NIST will also release for comment NIST SP 800-114 Revision 1 (Draft), User’s Guide to Telework
and Bring Your Own Device (BYOD) Security which will provide recommendations for securing BYOD devices used for
telework and remote access, as well as those directly attached to the enterprise’s own networks. NIST is also preparing
NIST SP 800-46 Revision 2 (Draft), Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD)
Security which will provide information on security considerations for several types of remote access solutions.
