Philippe LE TERTRE IS Governance Consultant

1. Philippe LE TERTRE IS Governance Consultant • Founder and managing partner of VADEGIS (company specialized in Information System Management and Governance) • IS governance consultant, certified by ISACA, (CGEIT) • Teacher at …….. • IS Auditor trained at IAE of Paris • Operational experience based on more than 20 years as CIO in international environment

2. Governance & management rules 1/4 Governance structure Goal : BYOD is subject to oversight and monitoring by management • BYOD policy must be approved by executive management • Executive management receives regularly scheduled status reports on BYOD usage • Executive management receives on risk management status report on regular basis Policies Goal : Policies supporting BYOD initiatives have been defined, documented, approved, implemented and maintained • Employee BYOD Agreement / Mobile Acceptable Use Policy (MAUP) • BYOD processes are integrated into HR services, policies, and compliance. • Limited access for third parties when connecting to the enterprise networks and IT systems • Exemptions from BYOD policies

3. Governance & management rules 2/4 Legal Goal : BYOD procedures comply with legal requirements and minimize the organization’s exposure to legal actions Technical and users support Goal : A support function, dedicated to BYOD area must be established to process technical and user issues • Impact analysis must be carried out to identify potential impacts and risk on BYOD approach • BYOD procedures must be updated according to the legal requirements • Identifying skills and competences needed for the BYOD environment • Setting up the process to support BYOD usage within the enterprise

4. Governance & management rules 3/4 Risk management Goal : BYOD is subject to routine risk assessment processes Training Goal : BYOD users attend initial orientation training and regular follow-up training • BYOD Initial Risk Assessment (prior to implementing the BYOD program) • (data confidentiality, juridical, human, technical,..) • BYOD Ongoing Risk Assessment • Initial Training : BYOD users are required to attend initial training on BYOD policy and procedures • Security and Awareness Training : Security awareness, at least annually

5. Governance & management rules 4/4 Mobile device management Goal : Enterprises has to use an Identification and Maintenance of Configuration Items Mobile device layer security Goal : BYOD users are required to maintain basic security procedures for the device • Central management of BYOD devices characteristics, configuration, owner,.... • Central management of IT procedures / Monitoring of BYOD usage • Remote management • ....... • Device Access Restrictions: BYOD users are required to restrict access to their devices. • Data Access / Encryption / Data Protection • Malware Protection: BYOD mobile devices are required to have standard anti-malware defenses. • …….

6. Maturityassessment, example and tools This spider graph is an example of the assessment results and maturity target for a BYOD management assessment Link to COBIT process

7. GoingFurther …Conclusion BYOD phenomenon is a risk but could be a value creation opportunity • Operational sales force tools • Attract talents • E-reputation • Users satisfaction / productivity • …….. BYOD reinforces the enterprise data management and governance needs • Data governance encourages behavior in the valuation, creation, storage, use, archival and deletion of data and information. It includes the processes, roles, standards and metrics that ensure the effective and efficient use of data and information in enabling an organization to achieve its goals. • Data policies • Data classification and valuation • Data quality (accuracy, accessibility, consistency, completeness,…..) • Data compliance • Data security • Data management and ownership • ………..

8. Questions Thanks for your attention