customer asks how we secure employee mobile devices

Mobile device management falls under access and business assets

This question relates to Article 21(2)(d) and (i) of NIS2: security in acquisition, development and maintenance, and access control including business asset management. Phones and tablets are business assets ('assets') once they can access company data — email, customer systems, shared drives. The customer wants to know if those devices are in a manageable state: are they registered, is there a password or PIN requirement, can a lost device be remotely wiped, is encryption enabled.

If an MDM solution (Mobile Device Management) is running — Intune, Jamf, Google Endpoint Management or equivalent — then that is the evidence: a screenshot of the policy profile, or a description of the configured rules (PIN, encryption, remote wipe, app restrictions). If MDM is absent, the answer is not automatically 'no': many smaller companies manage this with a bring-your-own-device policy plus a signed user declaration. Describe what is in place instead of skipping the question. This topic overlaps with the access policy including management of business assets — if an asset register and access matrix already exist there, mobile management logically belongs there and you can refer to the same source.

Without MDM and without policy, 'to be determined' is the honest label, not 'no': many customers accept a growth path, provided you indicate what is already in place and what is coming. Also state whether multi-factor authentication is mandatory for access from mobile devices — this is often a separate sub-question in the same list and is covered by the same control.

Where this appears in Annex A and the legislation

In ISO/IEC 27001 Annex A, mobile devices fall under the control measures for business asset management and access security; those already ISO-certified usually already have this evidence on file as part of the access policy. The Cybersecurity Act, which replaces the current NIS2 implementation rules at national level from 15 August 2026, does not change the classification of this measure — under Article 21(2).