4.12
IG3

Separate Enterprise Workspaces on Mobile End>User Devices

Asset Type: Devices
Security Function: Protect

Description

Ensure separate enterprise workspaces are used on mobile end-user devices, where supported. Example implementations include using an Apple® Configuration Profile or Android™ Work Profile to separate enterprise applications and data from personal applications and data.

Implementation Checklist

1
Assess current protection controls in place
2
Configure and deploy required security controls
3
Test control effectiveness in non-production environment
4
Deploy to production and verify functionality
5
Document configuration and operational procedures
6
Select hardening benchmark (CIS Benchmarks, DISA STIGs)
7
Create baseline configuration templates
8
Deploy configurations using automation tools
9
Schedule compliance scanning to detect drift

Threats & Vulnerabilities (CIS RAM)

Threat Scenarios

Personal App Compromise Exposing Enterprise Data

Confidentiality

Malware or vulnerabilities in personal applications on a mobile device access enterprise data because no workspace separation exists between personal and business contexts.

Enterprise Data Leakage Through Personal Apps

Confidentiality

Users inadvertently share enterprise data through personal messaging, social media, or cloud apps because business and personal data are co-mingled on the same device without separation.

Vulnerabilities (When Safeguard Absent)

No Enterprise Workspace Separation on Mobile Devices

Without separate enterprise workspaces, business data and personal data share the same device context, allowing personal apps unrestricted access to enterprise information.

Inability to Selectively Wipe Enterprise Data

Without workspace separation, removing enterprise data from a device requires a full wipe, making it impractical to remove only business data when an employee departs.

Evidence Requirements

Type Evidence Item Collection Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Configuration compliance scan results against approved baseline Scanned monthly
Document Approved baseline configuration documentation Reviewed quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually