ITPOL14 Bring Your Own Device Policy BYOD

ITPOL14

ITPOL14

Bring Your Own Device Policy (BYOD)

Page 1 of 12

Version:

Draft

Ratified By:

Finance & Risk Committee

Date ratified:

31/03/2021

Job Title of Author:

Assistant Director – IT & Systems

Reviewed by Sub Group or Expert Group:

Technology Programme Board

Equality Impact Assessed by:

Assistant Director – IT & Systems

Related Procedural Documents:

IGPOL53 Information Security Policy ITPOL13 – N365 Platform Policy & Guidance April 2024

Review Date:

It is the responsibility of users to ensure that you are using the most up to date document template – i.e. obtained via the intranet.

In developing/reviewing this policy Provide Community has had regard to the principles of the NHS Constitution.

Page 2 of 12

Version Control Sheet Version 1.0

Date March 2021

Author Status Comment Assistant Director IT & Systems Approved by FRC – 30/03/2021

Page 3 of 12

Contents 1.

Introduction ........................................................................................................... 5

2.

Scope ................................................................................................................... 5

3.

Purpose ................................................................................................................ 5

4.

BYOD Permitted Uses .......................................................................................... 6

5.

BYOD Security Requirements............................................................................... 6

6.

Approvals & Monitoring ......................................................................................... 6

7.

Financial Recompense ........................................................................................ 7

8.

Duties .................................................................................................................. 7

EQUALITY IMPACT ASSESSMENT TEMPLATE: Stage 1: ‘Screening’ ...................... 9 EQUALITY IMPACT ASSESSMENT TEMPLATE: Stage 2: ....................................... 11

Page 4 of 12

1. Introduction Bring Your Own Device (BYOD) covers technology devices such as laptops, tablets and smartphones and can bring many benefits: • • • • •

Employees are familiar with their device, no training is required Potential improvement of employee morale Employees only need to carry a single mobile device Mutually cost beneficial for the Provide Group and the staff member Employees may be more likely to take better care of a device that they have paid for and belongs to them

However, there are potentially negative considerations that mostly relate to the fact that whilst the ownership of the device belongs with the employee, the ownership of the data remains the responsibility of the data controller: • • • •

IT support is more complex Heightened security risks, such as malicious exploitation of devices through poor configuration or malware Heightened risk of accidental data loss, such as back ups of devices containing Provide Group data or devices being shared with family members Its more difficult to secure service user and company data

2. Scope This policy applies to all employees, contractors, temporary staff and volunteers of Provide CIC and all Provide Group companies where BYOD is offered.

At this point BYOD is not permitted for laptops, tablets or any other devices that would need to connect directly to any Provide Group network, any future change to this would be dependent upon the installation of a corporately managed Mobile Device Management solution on the personal device.

Staff are permitted in the circumstances described in this policy to use their own smartphone upon acceptance of the terms in this policy and agreement by their line manager.

No work related information will be permitted to be stored on BYOD smartphones.

3. Purpose To enable staff, where appropriate to safely and securely use a personal smartphone for Provide Group work by setting out the operating principles and rules that staff must adhere to, and by setting out the security controls that must be applied in order to reduce the risk of staff using personal mobile phones to a level of risk that falls within the risk appetite of the Provide Group.

Page 5 of 12

4. BYOD Permitted Uses Staff who are approved to use their personal smartphone will be allowed to do so for the following work-related purposes only: • • • • •

For tethering their laptop or tablet to for the provision of a mobile data connection.

The connection of the work tablet or laptops will itself be secured by a VPN solution.

For the use of phone calls (service user phone numbers must not be stored on the smartphone).

To send and receive work emails using a secure email account supplied by the Provide Group and used through O365.

To view documents that are accessible through O365 Joining a Microsoft Teams meeting with other employees, the meeting must not include any service users.

For clarity, uses do not include: • • • • • •

Directly connecting to the Provide network (this will not be made possible).

Taking or storing work related photographs of any type.

Using the smartphone to carryout virtual consultations.

The use of any work apps that contain Patient Identifiable Data (PID) or business sensitive information.

The use of NHSmail, other than through O365 Storage of any work information directly on the device

5. BYOD Security Requirements Devices being used for work purposes must comply with the following at all times: • • • • • • • • • • •

Use a strong password to secure the device Acceptance of security updates for apps and the operating system Use a supported version of the operating system Keep passwords secure Use biometric features to secure the device if possible Keep your operating system updated Be careful who can see your screen when accessing work systems Report lost or stolen devices Being aware of their responsibility for all costs Facilitate IT to conduct spot checks if required Don’t save work in unapproved locations or applications

Should a personal device be lost, this must be reported to the Provide Technology Team immediately and NHSmail password must be changed and personal number stored for the user may need to be updated. A Datix must be completed.

6. Approvals & Monitoring Staff must not use a personal phone for work purposes until they have received confirmation that their request is approved.

Page 6 of 12

The application process will include completion of a survey that will be assessed by the Technology Team to ensure how the phone will be used and the current security level of the phone. As part of the agreement, users may be asked to complete this information on an annual basis, at any point there is a concern and additionally each time they change their phone.

Details relating to the phone will be stored by the Provide Technology Team and used as the basis of when to re-validate users and may occur at times such as the users operating system going end of life.

Regular reports will be run in NHSmail to ensure NHSmail is not installed on personal mobile phones.

7. Financial Recompense Staff that qualify for a work issued smartphone and instead choose to use their personal smartphone will following approval receive a monthly payment to compensate them for each full month of use at the advertised rate, this amount will be re-charged to service budgets. The payment will be made as part of the monthly pay run and will not be pensionable. It is not expected to have any tax implications to individuals although tax rules and guidance is subject to change and out of the control of Provide.

Provide reserve the right to end the BYOD scheme at any point by giving a minimum of 30 days’ notice. Where staff still require the use of a mobile phone for work purposes, one would be supplied at the end of the scheme.

8. Duties 8.1 All Managers All managers are responsible for: • • • •

Ensuring that the staff they manage are aware of this policy and their individual responsibility for complying with it.

Ensuring staff are aware of the opportunities in this Policy and if they qualify to use their mobile phone or not.

Ensuring the processes required for users to be compensated for the use of their personal phone is followed in a timely manner.

Ensuring they complete the relevant leavers and joiners processes for their staff.

8.2 Technology Team The Technology Team are responsible for: • •

Regular review of the scope of this policy Reviewing and approving requests that must come via the staff members manager to the Provide Service Desk and sharing approved requests to the Finance Department.

Page 7 of 12

8.3 Finance Team The Finance Team are responsible for: • •

Ensuring that the appropriate Services are recharged in a timely manner Process Staff Change Forms for staff opting in to BYOD in a timely manner

8.4 All Staff All staff are responsible for: • •

Adhering with this Policy, including the permitted uses and security requirements Adhering with the N365 Platform Policy and Guidelines which should be read and understood before considering use of a personal mobile phone.

Page 8 of 12

EQUALITY IMPACT ASSESSMENT TEMPLATE: Stage 1: ‘Screening’ Name of project/policy/strategy (hereafter referred to as “initiative”): Bring Your Own Device (BYOD) Policy

Provide a brief summary (bullet points) of the aims of the initiative and main activities: To allow the use of personal phones where this safe to do so and is the preferred choice of the employee.

Project/Policy Manager: Assistant Director – IT & Systems

Date: March 2021

This stage establishes whether a proposed initiative will have an impact from an equality perspective on any particular group of people or community – i.e. on the grounds of race (incl. religion/faith), gender (incl. sexual orientation), age, disability, or whether it is “equality neutral” (i.e. have no effect either positive or negative). In the case of gender, consider whether men and women are affected differently.

Q1. Who will benefit from this initiative? Is there likely to be a positive impact on specific groups/communities (whether or not they are the intended beneficiaries), and if so, how?

Or is it clear at this stage that it will be equality “neutral”? i.e. will have no particular effect on any group.

Some Provide Group staff. This is more likely to give an opportunity for non-clinical staff but should be of no detriment to any staff.

Q2. Is there likely to be an adverse impact on one or more minority/under-represented or community groups as a result of this initiative? If so, who may be affected and why?

Or is it clear at this stage that it will be equality “neutral”?

No

Q3. Is the impact of the initiative – whether positive or negative - significant enough to warrant a more detailed assessment (Stage 2 – see guidance)? If not, will there be monitoring and review to assess the impact over a period time? Briefly (bullet points) give reasons for your answer and any steps you are taking to address particular issues, including any consultation with staff or external groups/agencies.

No, this is an opportunity for situations where the job allows. All staff within the relevant safe criteria will be offered this opportunity. The policyscope and this assessment will be reviewed each time the policy is.

Page 9 of 12

Guidelines: Things to consider • • •

• • •

•

Equality impact assessments at Provide take account of relevant equality legislation and include age, (i.e. young and old,); race and ethnicity, gender, disability, religion and faith, and sexual orientation.

The initiative may have a positive, negative or neutral impact, i.e. have no particular effect on the group/community.

Where a negative (i.e. adverse) impact is identified, it may be appropriate to make a more detailed EIA (see Stage 2), or, as important, take early action to redress this – e.g. by abandoning or modifying the initiative. NB: If the initiative contravenes equality legislation, it must be abandoned or modified.

Where an initiative has a positive impact on groups/community relations, the EIA should make this explicit, to enable the outcomes to be monitored over its lifespan.

Where there is a positive impact on particular groups does this mean there could be an adverse impact on others, and if so can this be justified? - e.g. are there other existing or planned initiatives which redress this?

It may not be possible to provide detailed answers to some of these questions at the start of the initiative. The EIA may identify a lack of relevant data, and that data-gathering is a specific action required to inform the initiative as it develops, and also to form part of a continuing evaluation and review process.

It is envisaged that it will be relatively rare for full impact assessments to be carried out at Provide. Usually, where there are particular problems identified in the screening stage, it is envisaged that the approach will be amended at this stage, and/or setting up a monitoring/evaluation system to review a policy’s impact over time.

Page 10 of 12

EQUALITY IMPACT ASSESSMENT TEMPLATE: Stage 2: (To be used where the ‘screening phase has identified a substantial problem/concern) This stage examines the initiative in more detail in order to obtain further information where required about its potential adverse or positive impact from an equality perspective. It will help inform whether any action needs to be taken and may form part of a continuing assessment framework as the initiative develops.

Q1. What data/information is there on the target beneficiary groups/communities?

Are any of these groups under- or over-represented? Do they have access to the same resources? What are your sources of data and are there any gaps?

Q2. Is there a potential for this initiative to have a positive impact, such as tackling discrimination, promoting equality of opportunity and good community relations? If yes, how? Which are the main groups it will have an impact on?

Q3. Will the initiative have an adverse impact on any particular group or community/community relations? If yes, in what way? Will the impact be different for different groups – e.g. men and women?

Q4. Has there been consultation/is consultation planned with stakeholders/ beneficiaries/ staff who will be affected by the initiative? Summarise (bullet points) any important issues arising from the consultation.

Q5. Given your answers to the previous questions, how will your plans be revised to reduce/eliminate negative impact or enhance positive impact? Are there specific factors which need to be taken into account?

Page 11 of 12

Q6. How will the initiative continue to be monitored and evaluated, including its impact on particular groups/ improving community relations? Where appropriate, identify any additional data that will be required.

Guidelines: Things to consider • •

• •

An initiative may have a positive impact on some sectors of the community but leave others excluded or feeling they are excluded. Consideration should be given to how this can be tackled or minimised.

It is important to ensure that relevant groups/communities are identified who should be consulted. This may require taking positive action to engage with those groups who are traditionally less likely to respond to consultations, and could form a specific part of the initiative.

The consultation process should form a meaningful part of the initiative as it develops, and help inform any future action.

If the EIA shows an adverse impact, is this because it contravenes any equality legislation? If so, the initiative must be modified or abandoned. There may be another way to meet the objective(s) of the initiative.

Further information: Useful Websites www.equalityhumanrights.com Website for new Equality agency www.employers-forum.co.uk – Employers forum on disability www.disabilitynow.org.uk – online disability related newspaper www.efa.org.uk – Employers forum on age © MDA 2007 EQUALITY IMPACT ASSESSMENT TEMPLATE: Stage One: ‘Screening’

Page 12 of 12