Separate Enterprise Workspaces on Mobile End>User Devices
Description
Ensure separate enterprise workspaces are used on mobile end-user devices, where supported. Example implementations include using an Apple® Configuration Profile or Android™ Work Profile to separate enterprise applications and data from personal applications and data.
Implementation Checklist
Tool Recommendations
Security configuration management and file integrity monitoring platform with policy compliance and drift detection
Fortra (Tripwire) · Per-node subscription
Cloud-based configuration assessment and compliance platform with CIS Benchmark support and continuous monitoring
Qualys · Per-asset subscription
Automated CIS Benchmark assessment tool for configuration compliance scanning across OS, applications, and cloud
Center for Internet Security · CIS SecureSuite membership
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Personal App Compromise Exposing Enterprise Data
ConfidentialityMalware or vulnerabilities in personal applications on a mobile device access enterprise data because no workspace separation exists between personal and business contexts.
Enterprise Data Leakage Through Personal Apps
ConfidentialityUsers inadvertently share enterprise data through personal messaging, social media, or cloud apps because business and personal data are co-mingled on the same device without separation.
Vulnerabilities (When Safeguard Absent)
No Enterprise Workspace Separation on Mobile Devices
Without separate enterprise workspaces, business data and personal data share the same device context, allowing personal apps unrestricted access to enterprise information.
Inability to Selectively Wipe Enterprise Data
Without workspace separation, removing enterprise data from a device requires a full wipe, making it impractical to remove only business data when an employee departs.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Technical | Configuration compliance scan results against approved baseline | Scanned monthly |
| Document | Approved baseline configuration documentation | Reviewed quarterly |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |