S 6.72 Precautions relating to mobile phone failures

Initiation responsibility: Head of IT Section, IT Security Management

Implementation responsibility: Head of IT Section, users

There are a number of reasons why a mobile phone could fail or its operational capability could be impaired. This is of course particularly annoying when the mobile phone is needed urgently or the result of its being unoperational is that important data is lost. Therefore appropriate precautions should be taken in advance to avert the possibility of failure or at least minimise any problems which this will entail.

The state of charge and functional condition of the mobile phone battery should be checked at regular intervals (see also S 4.115 Safeguarding the power supply of mobile phones).

All data stored on the mobile phone such as telephone directory entries, messages etc should be saved to a different medium at regular intervals so that in case of doubt they can be reconstructed. A number of possibilities are available here:

• The most important settings, PINs and the configuration of security mechanisms should be documented in writing and stored securely to reflect the relevant protection requirements.

• All data which is stored on the SIM card, e.g. telephone directories, can be read into a PC with a SIM card reader and appropriate software and managed there. This has the further advantage that address data is easier to maintain and synchronise with other address databases on a PC than on a mobile phone. In particular, where several mobile phones are used (see also S 2.190 Setting up a mobile phone pool) it is appropriate to use such means to make sure that all telephone directories are consistent with each other. If only the data on the SIM card is backed up, all the users must be informed that they should always save call numbers and similar there.

• The mobile phone can also be coupled with another IT system, e.g. a notebook or organiser, which in turn is then used to exchange the data to be backed up (see also S 5.81 Secure transmission of data over mobile phones). Here, the data held both on the SIM card and also in the phone itself can be backed up.

If it is important that a mobile phone is available at all times, a spare mobile phone, or at least a spare battery, should be carried too.

Where mobile phones play a critical role in the generation of alarms, e.g. if an intruder detection device sends alarm messages over GSM or emergency personnel are to be informed by mobile phone, a contingency option must always be available.

Repairs

When a mobile phone develops a fault, it could be that the entire device fails or only individual components. Repairs should only be undertaken by trusted specialist businesses. For this reason, a list of appropriate specialist businesses should be available.

Many dealers also provide replacement equipment for the duration of the repairs. With devices like mobile phones, where the technology is changing all the time, it is often not worth performing a repair so that sometimes a replacement device is offered. Since it is particularly important with a mobile phone that the device is available at all times, when selecting the mobile phone or dealer care should be taken to ensure that such services are offered.

Before taking the mobile phone to be repaired, all personal data, e.g. the call memory, any e-mails saved and the telephone directory held on the phone should be deleted (see also S 2.4 Maintenance/repair regulations). It goes without saying that these should be backed up first. The SIM card should also be removed.

Additional controls:

• Does the contingency plan include a list of dealers who specialise in mobile phones?

• Is data stored on mobile phones backed up at regular intervals?