D7: Anyone deploying or using a mobile device management system other than Microsoft ActiveSync must contact the University Security Office.

D6: Any actual or suspected loss, theft, or improper use of a device storing confidential information must be reported promptly.

D5: The information stored on the device must be protected against access when the device is disposed of.

D4: Client applications on the device which might be used to access or transfer confidential information must be configured to protect their communications.

D3: Operating system and application patches must be applied promptly.

D2: The information stored on the device must be protected against access if the device is lost, stolen, or recycled/reissued to another user. All mobile devices (laptops, mobile phones, etc.) and workstations that may be used to store or access Harvard information, including accessing Harvard email, must be securely configured, including encryption of data stored on the device, where this feature is supported.

Note: Enforcement of configurations for personally-managed devices will be phased in, beginning with alerts of non-compliance and grace periods to resolve detected gaps.
D1: All devices connecting to or installed on a non-guest Harvard network or authenticating to Harvard applications must be configured for secure operation, including non-default unique passwords/credentials that limit access to authorized individuals and services, proper registration of the device on the network, current and supported operating system (firmware and software), regular updates and...