Mu Phàrlamaid na h-Alba

Introduction

1. The Scottish Parliament Corporate Body (SPCB) recognises the importance of technologies which enable Members, Members Staff, SPCB staff and SPCB contractors to carry out their day-to-day parliamentary duties effectively.

2. The SPCB provides mobile devices for Members, their staff, SPCB Staff and SPCB Contractors where there is a demonstrable business need.

3. As per other Parliamentary resources, mobile devices are provided by the SPCB to support the undertaking of Parliamentary duties and must not be used to any significant extent for any other purpose, including any party-political purpose.

4. Where appropriate, Parliamentary mobile devices will be provided with a SIM to allow connection to the mobile voice and data network operated by the current mobile provider contracted to the Parliament. An appropriate data package based on expected usage pattern will be discussed and agreed prior to issue.

Request a mobile device

5. If you require a SPCB mobile device to effectively undertake your Parliamentary duties you should complete a BIT work request. For SPCB Staff, we will seek approval from their Office Head before proceeding. Members' staff should seek approval from their employing Member prior to submitting the request.

Receipt of the device

6. When you are issued a device, you will be required to acknowledge receipt of the device and you will be required to confirm that you have read and agree to the contents of this policy. A copy of the receipt will be kept on record until you return the device.

7. The device will have a label with a unique identifying asset number. This label will also identify the device as belonging to the SPCB. The label should not be removed and will remain on the device for the full working life of the device.

8. When the device is issued to you, BIT will ensure that it can connect to the Scottish Parliament WiFi Network and will ask you to set up a PIN code to secure the device.

9. A mobile device management application will be installed which will enable appropriate remote management of the device by BIT and the device will be configured to receive your Parliament email.

10. Devices issued to you will be set to automatically update and you must not change these settings or unreasonably delay updates to your devices.

Use of the device

11. You are accountable for the safekeeping of the device issued to you by the SPCB and you should not allow non-Parliament IT account holders to use the device.

12. Mobile devices issued to you remain the property of SPCB and you must ensure the device is kept secure and is returned before you leave the organisation or when requested by BIT. Thefts or losses should be reported immediately to the BIT Helpdesk and the police and a theft or losses form completed as soon as practicable. Should you be abroad at the time of the theft/loss, you will need to report this to the police in the country you are in and obtain a crime number or equivalent.

13. You must use a secure password or PIN to lock your mobile device and prevent unauthorised access. Your password or PIN should never be shared with anyone and should be supplemented by biometric controls where available (e.g. FaceID, TouchID, etc).

14. To help ensure the security of Parliamentary systems, mobile devices and applications must be kept up to date and operate only supported versions of software.

15. The SPCB reserves the right to install and update software on all of our devices to aid remote management and to prevent access to Parliament systems from devices which do not meet a minimum acceptable cyber-security baseline, which have potentially dangerous apps installed, or which have been modified or reconfigured to bypass necessary security controls or features.

16. Limited urgent personal use can be undertaken, but you will be liable for any excess charges arising from personal use and should make arrangements to identify and repay any personal charges incurred.

17. The mobile network provider contracted to the Parliament will occasionally change as contracts come to an end. Users of SPCB mobile devices will be informed of any change and arrangements will be made to move to the new supplier. Failure to move to the new supplier within an agreed timeframe will result in the suspension of service.

18. Sending multimedia messages (sending a photo via a text message) incurs an additional charge per message and alternative methods of sharing photos should be used e.g. email, Teams, or other appropriate messaging application.

19. Calls and text messages to premium rate numbers are not included as part of the supplied voice and data package and will incur additional charges.

Travel with the device

20. To ensure best value for money is achieved for any data roaming needs, and so that advice on device security and operation can be given, all mobile device users must inform the BIT Helpdesk in advance of any proposed travel outside the UK.

21. Mobile users should not take a Parliament device abroad unless intending to undertake parliamentary duties whilst away.

22. Members' primary mobile device (smartphone) will be enabled for data roaming by default, all other mobile devices will need to be enabled prior to travelling.

23. A minimum of 2 working days’ notice should be given to BIT to ensure a smooth roaming experience.

24. Should BIT not be informed prior to travel, and excess roaming charges be incurred, you will be personally liable for any costs incurred over £60.

25. Where travel could not have been foreseen in advance, an application can be made to the SPCB, or Head of Office in case of Parliament staff, to fund any excess charges incurred in pursuit of Parliamentary business from central budgets.

26. Certain countries present additional cyber-security risks and, on rare occasions, you may be advised not to take a Parliament device or to take a temporary device which BIT will issue. Such guidance will be based on advice from the relevant National Technical Authority and/or security services.

27. Although most countries across the world support data roaming, certain countries may not support data roaming through the contracts used by the SPCB. If this is the case BIT will advise how best to connect to services whilst visiting these countries for business purposes.

Reporting and monitoring

28. The BIT Office reports quarterly to the SPCB by exception on mobile device use. This information will be published in line with other SPCB papers. Any costs met from the Members’ Expense Scheme will continue to be published as part of the normal quarterly publications scheme.

29. The billing systems for mobile SIMs issued by the SPCB provide data volume information for each mobile contract to enable effective scrutiny of the invoice received centrally. The SPCB will review these records to ensure adherence to this policy, to provide assurance that billing information is correct, or to meet our obligations under Freedom of Information.

Return of devices

30. The devices issued to you remain the property of the SPCB and must be returned to the BIT Office along with their charger if they are no longer required for business purposes, or if you are leaving the organisation.

31. To arrange return, contact the BIT Helpdesk to arrange drop off or collection.

32. As part of the return process, you will receive a return receipt from BIT. You must check that this receipt correctly identifies the device you are returning and has the correct asset label number listed on the receipt.

33. Prior to returning you should turn off Find my [device] using your AppleID and reset back to factory defaults to ensure any sensitive data is removed. BIT staff can assist you with this as part of the return process.