Developing a Mobile Device Management Security Policy for Nigerian Commercial Banks

The proliferation of mobile devices in Nigerian commercial banking operations creates endpoint security, data protection, and BYOD management challenges that require formal MDM security policy frameworks aligned with CBN requirements and operational realities. This study developed a Mobile Device Management security policy for Nigerian commercial banks, drawing on current practice assessment at five Tier 1 banks in Lagos State, South West Nigeria. A professional policy development methodology was applied, incorporating review of CBN Operational Risk Guidelines and Payment Card Industry DSS requirements, structured consultations with 15 bank IT security managers, and technical assessment of MDM solutions deployed. Assessment of current MDM practices showed that corporate-managed devices had complete MDM coverage in 80.0 percent of reviewed banks, but BYOD management coverage was adequate in only 40.0 percent. Remote wipe capability was deployed for all registered devices in 60.0 percent of banks. Container-based separation of corporate and personal data was implemented in 40.0 percent. Application whitelisting for corporate mobile devices was in place in 60.0 percent. The MDM policy developed specifies device registration requirements, minimum security configuration standards, container management for BYOD, lost device response procedures, application management controls, and data retention and remote deletion obligations. Expert review by eight banking security and MDM specialists confirmed the policy's CBN compliance and operational adequacy. Recommendations include CBN minimum MDM standard incorporation into the Cybersecurity Framework for Financial Institutions.

Keywords: mobile device management, commercial banking, MDM policy, BYOD, Lagos