Accessing corporate information from smartphones and tablets is essential for productivity, but it also expands an organization’s attack surface. Aligning mobile device management with recognized security frameworks is a recurring technical challenge for IT and information security teams. These frameworks include Spain’s National Security Framework (Esquema Nacional de Seguridad, or ENS), with its Basic, Medium, and High categories, and ISO/IEC 27001, the international standard for information security management systems.
To make this work easier, Applivery offers predefined configuration templates for Android and iOS devices. The templates provide a security baseline that helps system administrators apply policies and restrictions to employees’ corporate devices and address the technical controls for each framework and category.
The templates give IT teams a practical starting point. Each organization has its own risk assessment, operational processes, and business needs, so teams can adjust or build on these configurations to meet their internal policies and specific requirements.
The templates focus on operating system security controls. To complete a deployment, each organization also needs to configure connectivity and access to its corporate resources. This includes corporate Wi-Fi profiles with the appropriate certificates or authentication protocols, corporate VPN client or gateway settings, and digital identity certificate provisioning.
Android templates for Spain’s National Security Framework
ENS Basic template for Android
This template applies a moderate level of security to Android devices with basic compliance requirements.
- Password. Requires at least 4 characters and low complexity. Passwords expire every 180 days.
- Restrictions. Blocks factory resets, app installation and removal, and adding or removing users.
- Allowed features. Allows camera use, screenshots, Bluetooth, USB, and file transfers.
- Security. Enables encryption and Common Criteria mode and enforces content protection.
- Google Play Store. Allows only approved apps.
- Reporting. Collects detailed information about apps, hardware, the network, and device status.
ENS Medium template for Android
This template applies a medium-to-high level of security to corporate Android devices that require tighter controls.
- Password. Requires at least 6 characters and medium complexity (alphanumeric). Passwords expire every 90 days, and the device is remotely wiped after 5 failed attempts.
- Restrictions. Blocks screenshots, camera use, Bluetooth, USB, app installation and removal, factory resets, and adding or removing users.
- Security. Enforces encryption and content protection and enables Common Criteria mode.
- Reporting. Collects detailed information about apps, the device, the network, power, and the system.
- Updates. Enforces automatic updates.
ENS High template for Android
This template applies the highest level of security for sensitive environments or devices that handle classified data.
- Password. Requires at least 8 characters and high complexity (alphanumeric and special characters). Passwords expire every 60 days, and the device is remotely wiped after 10 failed attempts.
- Encryption. Enforces password-protected encryption.
- Restrictions. Blocks screenshots, camera and microphone use, Bluetooth, USB, app installation and removal, factory resets, printing, and entertainment features.
- Security. Enables Common Criteria mode and applies stricter content protection.
- Applivery Self Service. Enforces installation and grants permissions for features such as location and usage statistics.
- Google Play Store. Allows only explicitly approved apps.
- Reporting. Monitors apps, the device, the network, power, and hardware.
Android settings across the three ENS categories
| Setting | Basic | Medium | High |
|---|---|---|---|
| Minimum password length | 4 characters | 6 characters | 8 characters |
| Password complexity | Low | Medium | High |
| Password expiration | 180 days | 90 days | 60 days |
| Camera | ✅ | ❌ | ❌ |
| Bluetooth | ✅ | ❌ | ❌ |
| USB | ✅ | ❌ | ❌ |
| Encryption | Basic | Enforced | Enforced with a password |
Android templates for ISO 27001
ISO 27001 template for Android
This template supports organizations that need ISO 27001 certification for information security management.
- Password. Requires at least 8 characters and high complexity (uppercase and lowercase letters, numbers, and symbols). Passwords expire every 60 days, and the device is remotely wiped after 10 failed attempts.
- Encryption. Enables encryption without requiring an additional password.
- Restrictions. Blocks screenshots, Bluetooth, USB, app installation and removal, factory resets, printing, and entertainment features.
- Security. Enables Common Criteria mode and enforces content protection.
- Google Play Store. Allows only approved apps.
- Monitoring. Provides detailed reports on apps, the device, the network, power, and hardware.
- Location. Users can choose whether to enable location services.
iOS templates for Spain’s National Security Framework
ENS Basic template for iOS
This template applies a moderate level of security to iOS devices with basic compliance requirements.
- Passcode. Requires at least 4 digits. Passcodes expire every 180 days. The policy allows a maximum of 10 failed attempts, permits passcode reuse, and includes a 7-day grace period.
Blocked features
- ❌ App installation and removal
- ❌ In-app purchases (IAP)
- ❌ Game Center
- ❌ AirDrop and AirPrint
- ❌ Siri
- ❌ Incoming AirPlay requests
- ❌ All iCloud services, including backups, documents, iCloud Keychain, iCloud Photo Library, and Photo Stream
Allowed features
- ✅ Screenshots
- ✅ Changes to the passcode, device name, default browser, and default apps
- ✅ Handoff and Universal Control
- ✅ Find My features for devices and friends
- ✅ Dictation, autocorrection, predictive typing, and dictionary lookups
ENS Medium template for iOS
This template applies an intermediate level of security to iOS devices in medium-risk environments.
- Passcode. Requires at least 6 alphanumeric characters. Passcodes expire every 90 days, and the device locks after 5 failed attempts.
- Data protection. Requires encrypted backups, a managed pasteboard, and authentication before AutoFill.
Blocked features
- ❌ Screenshots
- ❌ AirDrop, AirPlay, and AirPrint
- ❌ App installation and removal
- ❌ In-app purchases (IAP)
- ❌ Game Center
- ❌ All iCloud services, including backups, documents, iCloud Keychain, iCloud Photo Library, Photo Stream, and iCloud Private Relay
- ❌ Account changes
- ❌ Siri
Allowed features
- ✅ Camera
- ✅ Mail, Notes, and Reminders
- ✅ Managed pasteboard
- ✅ Universal Control
- ✅ Autocorrection, predictive typing, and dictionary lookups
- ✅ USB Restricted Mode
ENS High template for iOS
This template applies the highest level of security for ENS compliance and is designed for corporate devices that handle sensitive data.
- Passcode. Requires at least 8 alphanumeric characters. Passcodes expire every 60 days, and users cannot reuse their last 10 passcodes. The policy allows a maximum of 3 failed attempts and has no grace period.
- Encryption. Requires encrypted backups.
- Connectivity. Keeps Wi-Fi on, allows connections only to approved networks, and blocks cellular data.
Blocked features
- ❌ App installation and removal, including installation from the App Store and the web
- ❌ In-app purchases (IAP)
- ❌ Game Center and explicit content
- ❌ Screenshots
- ❌ Bluetooth and Personal Hotspot
- ❌ AirDrop, Handoff, and AirPrint
- ❌ All iCloud services, including backups, documents, iCloud Keychain, iCloud Photo Library, Calendar, Contacts, and Photo Stream
- ❌ Siri
- ❌ Find My features for devices and friends
- ❌ Changes to restrictions, Safari, default apps, accounts, and the device name, as well as erasing device content
Allowed features
- ✅ Camera
- ✅ Mail, Notes, and Reminders
- ✅ Managed pasteboard
- ✅ Universal Control
- ✅ Autocorrection, predictive typing, and dictionary lookups
- ✅ USB Restricted Mode
Assigned app
- Applivery Self Service (v2.4.0). The policy enforces installation as a managed app.
Agent telemetry
- ❌ Location data collection is disabled.
- ✅ Device, battery, Bluetooth, system, and network data collection is enabled.
iOS templates for ISO 27001
ISO 27001 template for iOS
This template applies a high level of security for ISO 27001 and is designed for devices that handle sensitive data in highly regulated environments.
- Passcode. Requires at least 8 characters, including letters, numbers, and complex characters. Passcodes expire every 60 days, and users cannot reuse their last 3 passcodes. The policy allows a maximum of 10 failed attempts and sets a maximum idle time of 2 minutes.
- Encryption. Requires encrypted local backups and blocks iCloud backups.
- Wi-Fi. Keeps Wi-Fi on and allows connections only to approved networks.
Blocked features
- ❌ AirDrop, AirPlay, AirPrint, and changes to Bluetooth settings
- ❌ All iCloud services, including backups, documents, iCloud Keychain, iCloud Photo Library, and iCloud Private Relay
- ❌ Siri, Game Center, and explicit content
- ❌ App installation and removal, and in-app purchases
- ❌ Account changes and erasing device content
- ❌ Find My features for devices and friends, and remote screen viewing
- ❌ Access to USB and network drives
Allowed features
- ✅ Camera and video conferencing
- ✅ Screenshots
- ✅ Restricted USB access
- ✅ Managed pasteboard, required for copying and pasting between apps
Telemetry
Telemetry is disabled, including collection of location, battery, Bluetooth, and system information.