Does PCI DSS 1.4 include tablets and smartphones?

Question

1.4 install personal firewall software on any mobile and/or employee-owned computers with direct connectivity to the Internet (for example, laptops used by employees), which are used to access the organization’s network.

If company employees have their own mobile devices that don't connect to the internal network however they do connect to an internet facing company mail server using encryption. In this case does this apply? How about for company owned phones with the same setup?

My thinking is that neither employee owned nor company owned phones would apply as long as there's no cardholder data in their email that would get stored on their phones. Any clarification on this would be greatly appreciated.

Answer 1

Email servers can be considered an 'outside' company resource, depending on configuration. In that case, if the mobile device only connects to the email server, it is not connecting to the internal network and therefore would not apply to the 1.4 requirement.

But I can think of configurations where accessing the email server could be considered 'inside' access, so I can't make a blanket statement. That's why there are consultants to handle these questions for your specific instance.