Security Guidance
RSS feed
Table of contents

Personal devices

This guidance applies to all staff and contractors who work for the Ministry of Justice (MoJ). It provides advice about using personal devices for work purposes.

Related information

Bluetooth

Overview

A personal device is any desktop, laptop, tablet, phone, external drive, or similar device that the MoJ does not own.

Note: ‘Personal devices’ include all personally-owned devices with processing ability or Internet connectivity. This includes all types of assistance, organisational or Internet of Things (IoT) devices. Connected vehicles are a special case discussed in this guidance. In case of any doubt, ask for help about specific examples.

Not everyone has access to an MoJ device for remote use. If you need equipment, you can request it. It can be provided quickly. Contact your Line Manager for details. A request can then be raised through the IT Service Desk.

In unusual circumstances, it might not be possible to organise provision of equipment. In such cases, you can request access to an MoJ virtual environment.

Except when connecting to an MoJ virtual environment, or with documented approval in exceptional circumstances as described in this guidance, you shall not use a personal device for work purposes.

Avoid connecting peripherals to MoJ devices, unless those peripherals are supplied or approved by the MoJ. Examples of peripheral devices include USB, wireless, or Bluetooth keyboards or mice.

Note: Exemptions are possible for connecting peripherals where accessibility support is required. Contact your Line Manager for documented approval before connecting a peripheral device.

Personal devices shall not be charged from the USB ports of an MoJ device.

Note: Specifically: a personal mobile phone shall not be charged from the USB ports of an MoJ device.

Guidance

  • If you have an MoJ-issued device or virtual environment, you shall use that.
  • You shall not use a personal device to access Google Workspace tools such as Gmail, Docs, Slides, Sheets, Drive, Meet, or Hangouts for work purposes.
  • You shall not use a personal device to access Office 365 tools such as Outlook email or calendar, Word, Excel, or PowerPoint for work purposes.
    • Wherever possible, an MoJ work device should be used to join business Teams calls, either via video or dial in.
    • In cases where staff have not been provided with a work phone or laptop or any other work device which allows them to join or dial into Teams, staff may join from their personal devices as a Guest. The chair of the meeting shall confirm the identity of each and every person joining their call as a Guest.
  • This guidance applies to all tools accessed through a web browser or installed client applications.
  • You shall not send MoJ information to your personal email account.
  • You shall not use personal accounts for work purposes.
  • You shall not store work files or information on a personal device such as a desktop, laptop, tablet or phone.
  • You shall not store work files or information on a personal storage device or memory stick, such as an external drive, thumb drive, or USB stick.
  • Some teams within the MoJ might have permission to use personal devices for some tasks. This permission continues, but is being reviewed on an on-going basis. Ensure that you have documented approval recording your permission. Ensure that the permission is no more than 12 months old. To request or refresh permission, ask your Line Manager to seek approval by checking with the Security team.

Note: You are not asked or required to use your own devices for work purposes. Statement POL.MOB.009 of the mobile device and remote working policy makes clear that you should not use personal devices for MoJ work purposes. If you have access to MoJ devices for work purposes, you shall use them by default. A special case is that if you do not have an MoJ-issued mobile phone, you may use a personal device to receive Multi-factor authentication (MFA) codes or messages which authorise access by MoJ devices to MoJ systems.

Using MoJ tools on personal devices

In accordance with other policy on the use of personal devices, and the use of mobile devices specifically, you shall not use personal devices to access MoJ tools, such as MoJ Slack workspaces.

Note: The rest of this section refers to Slack workspaces, but applies equally to other MoJ tools, such as Teams, Trello, Jira, and so on.

You could of course use personal devices to access other (non-MoJ) Slack communities.

The point is that you should not use personal devices for MoJ work purposes. Slack workspaces are official MoJ workspaces and should only be accessed using MoJ devices.

Personal devices are not allowed to access services or content containing Official-Sensitive data. Work devices shall be used to access MoJ services such as MoJ Slack communities. If you do not have a work mobile device, and need to access services such as Slack on a mobile device, you should request one using Service Now.

Virtual environment

The MoJ provides access to a Virtual Environment to help with exceptional circumstances. This is where suitable provision of a physical device is not possible.

Request a virtual environment through the Creation of WVD instances product offering within the Service Catalogue in MoJ Service Now.

Note: A virtual environment does not offer the same capabilities or performance as a physical MoJ-issued device. Using an MoJ-issued device is always preferable.

Connected vehicles

Connected vehicles are effectively Bluetooth-connected storage devices. They are considered personal devices for the purposes of this guidance, regardless of whether they are owned, leased or rented.

Automatic transfer of contact information and calendar events might happen during the pairing process. The resulting transferred data is accessible to any third party who subsequently pairs their mobile device to the vehicle.

Additionally, although such platforms usually offer an option to delete paired profiles, there is currently no confirmation that the data is actually erased to a satisfactory level. Transferred information might not be immediately visible or accessible, but this is not the same as deleting the information from the vehicle.

For these reasons, MoJ devices shall not be paired with Bluetooth-enabled vehicles.

Contact details

For any further questions or advice relating to security, contact: security@justice.gov.uk.

Feedback

If you have any questions or comments about this guidance, such as suggestions for improvements, please contact: itpolicycontent@digital.justice.gov.uk.