1.4 install personal firewall software on any mobile and/or employee-owned computers with direct connectivity to the Internet (for example, laptops used by employees), which are used to access the organization’s network.
If company employees have their own mobile devices that don't connect to the internal network however they do connect to an internet facing company mail server using encryption. In this case does this apply? How about for company owned phones with the same setup?
My thinking is that neither employee owned nor company owned phones would apply as long as there's no cardholder data in their email that would get stored on their phones. Any clarification on this would be greatly appreciated.