SP 800-124 Rev. 2Final2023

Guidelines for Managing the Security of Mobile Devices in the Enterprise

At a glanceHow to secure smartphones and tablets that reach district systems, whether district-owned or personal. It catalogs mobile threats and the management tools that address them, such as mobile device management. Useful for districts with staff phones, tablets or student devices under management.

Reading level: Technical
Length: 61 pages · about 40 min for the key parts
Best for: Technology directors, IT staff and service partners
CSF 2.0: Protect, Identify

Read it on NIST DOI 10.6028/NIST.SP.800-124r2 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Key concepts

The guide describes mobile threats (loss and theft, phishing, malware, misconfiguration, unmanaged apps, stolen management-console credentials) and countermeasures, then walks through a device deployment life cycle from policy and design to operation and disposal.

How it is organized

Mobile device characteristics and communication
Threats to the mobile enterprise
Mobile security technologies: device-side controls, device management, mobile threat defense, app vetting
Deployment life cycle: policy, design, test, deploy, operate, dispose
Appendix: threat mitigations table

What a school district should take from it

The device management console is a high-value target; protect its administrator accounts with strong MFA.
Lost-device procedures (locate, lock, wipe) should be documented and practiced.

How to use it in your district

Enroll district phones and tablets in device management with a baseline configuration.
Protect device management administrator accounts with phishing-resistant MFA.
Define what a personal device may access and what happens when staff leave.
Include mobile devices in the asset inventory and the sanitization procedure.

Common misconceptions

Phones and tablets are low risk because they are not computers.: They hold email, credentials and student data, and they are easy to lose.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

PR.PSPlatform Security
PR.DSData Security
ID.AMAsset Management

Tools in the program portal

District operations toolkitLocal scripts for inventory and configuration checks
Evidence collection kitsCollect configuration evidence from Microsoft 365, Google and more
Policy BuilderDraft policy language tied to rubric categories

Related publications

SP 800-88 Rev. 2Wiping and disposing of devices
SP 800-46 Rev. 2Remote access and BYOD

Citation and source

SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise. National Institute of Standards and Technology. 2023. https://doi.org/10.6028/NIST.SP.800-124r2.

Replaces: SP 800-124 Rev. 1 (2013).

Topics: Devices and malware. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.