Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

NIST SP 1800-4 (Initial Public Draft)

Mobile Device Security: Cloud and Hybrid Builds

Date Published: November 2015
Comments Due: January 8, 2016 (public comment period is CLOSED)
Email Questions to:


Joshua Franklin (NIST), Kevin Bowler (MITRE), Christopher Brown (MITRE), Neil McNab (MITRE), Matthew Steele (MITRE)


Mobile devices allow employees to access information resources wherever they are, whenever they need. The constant Internet access available through a mobile device's cellular and Wi-Fi connections has the potential to make business practices more efficient and effective. As mobile technologies mature, employees increasingly want to use mobile devices to access corporate enterprise services, data, and other resources to perform work-related activities. Unfortunately, security controls have not kept pace with the security risks that mobile devices can pose.

If sensitive data is stored on a poorly secured mobile device that is lost or stolen, an attacker may be able to gain unauthorized access to that data. Even worse, a mobile device with remote access to sensitive organizational data could be leveraged by an attacker to gain access to not only that data, but also any other data that the user is allowed to access from that mobile device. The challenge lies in ensuring the confidentiality, integrity, and availability of the information that a mobile device accesses, stores, and processes. Despite the security risks posed by today's mobile devices, enterprises are under pressure to accept them due to several factors, such as anticipated cost savings and employees' demand for more convenience.


The NIST Cybersecurity Practice Guide, Mobile Device Security: Cloud and Hybrid Builds, demonstrates how commercially available technologies can meet your organization's needs to secure sensitive enterprise data accessed by and/or stored on employees' mobile devices.

In our lab at the National Cybersecurity Center of Excellence (NCCoE), we built an environment based on typical mobile devices and an enterprise email, calendaring, and contact management solution.

We demonstrate how security can be supported throughout the mobile device lifecycle. This includes how to:

  • configure a device to be trusted by the organization
  • maintain adequate separation between the organization's data and the employee's personal data stored on or accessed from the mobile device
  • handle the de-provisioning of a mobile device that should no longer have enterprise access (e.g., device lost or stolen, employee leaves the company.



mobile; mobility management; mobile security; mobile device; mobile device management
Control Families

None selected


Draft SP 1800-4

Supplemental Material:
Project homepage

Related NIST Publications:
Project Description

Document History:
11/02/15: SP 1800-4 (Draft)
02/21/19: SP 1800-4 (Final)



cloud & virtualization, mobile