Mobile Device & Remote Working Policy

Governs secure use of endpoints and remote access to Finaisse systems. Subordinate to the Information Security Policy and complements the Acceptable Use Policy.

Policy owner	Security & Infrastructure Owner (Sekhar)
Applies to	All personnel accessing Finaisse systems remotely or on mobile devices
Effective	2026-08-27 (v0.1 draft)
Review cadence	Annual
Classification	Internal-confidential
ISO	A.6.7, A.8.1

1. Purpose

Ensure that remote and mobile access to Finaisse systems does not weaken the platform's security. Finaisse is remote-first; access is over the internet to cloud-hosted systems.

2. Device requirements

🎯 Target — endpoints used to access production systems or source control meet a baseline: full-disk encryption, automatic screen lock, current OS and security patches, and reputable endpoint protection.

3. Remote access

• Access to management, infrastructure, and source-control systems is via SSO/2FA (GitHub, Railway, Cloudflare Access — see Access Control Policy).
• No standing secrets are stored on endpoints; credentials are held in the platform secret store.
• Public/untrusted networks require care; sensitive work uses trusted connections.

4. Device change, loss & compromise

4.1 Loss or compromise

A lost or compromised device that could access Finaisse systems is reported immediately per the Incident Response Policy; associated access is revoked and credentials rotated.

4.2 Replacement or return of a working device

A device replaced for non-security reasons (hardware failure, upgrade, return at end of use) is not an incident, but it leaves access artifacts behind. The device enrolment is a record of granted access, so retiring the hardware and retiring the enrolment are two separate acts and both are required:

• The Zero Trust device registration for the retired device is revoked and deleted (Cloudflare Zero Trust → Team & Resources → Devices). A registration left in place remains a valid enrolment on hardware no longer under the person's control.
• The replacement device is enrolled before it is used for Finaisse work — WARP installed and signed in to the finaisse Zero Trust organisation, so Gateway policy and the device inventory apply to it.
• Where the retired device held any local credential (a Personal Access Token, an SSH key, a cached .env), that credential is rotated rather than assumed inert, per the Access Control Policy.
• The device is wiped before reissue or disposal, and asset return is recorded per the Asset Management Policy.

The enrolled-device list is the record of which endpoints hold access, so it is only meaningful if it tracks reality: a stale registration overstates control, and an unenrolled endpoint is invisible to Gateway policy and to the inventory. Both failure modes are silent — neither raises an alert — so the check is procedural, performed at the point of device change.

🎯 Target — a periodic reconciliation of enrolled devices against current personnel, so that a stale registration or an unenrolled endpoint is detected rather than noticed (F-33, Domain 20).

5. Review

Reviewed annually.

Revision history

Version	Date	Author	Change
0.1	2026-08-27	Security & Infrastructure Owner	Initial draft
0.2	2026-09-03	Security & Infrastructure Owner	§4 extended to cover replacement/return of a working device (enrolment revocation + re-enrolment), not only loss or compromise