A framework for Responsibly Mobile. kpmg.com

Transcription

1 A framework for Responsibly Mobile kpmg.com

2 2 A framework for Responsibly Mobile

3 A framework for Responsibly Mobile 1 Contents 02 Introduction 03 Common Challenges and Risk Considerations 04 Defining the KPMG Enterprise Mobility Framework 04 Business Transformation 05 Governance and Center of Excellence 06 Strategy 07 Delivery 08 Operations Balancing Opportunity and Risk Conclusion About the authors Martin Sokalski is a Managing Director in the KPMG IT Advisory Services practice. His focus is on mobile enablement and emerging technology risk. Martin has worked with clients across a variety of industries and functions to help establish mobile strategies, target operating and governance models, app development and delivery, and info security, privacy, and compliance related functions and capabilities. Max Hanson is a Manager in KPMG s IT Advisory practice and provides advisory and attestation related services to clients across various functions and industries. His primary focus has been assisting clients assess and mitigate risk pertaining to emerging technologies, specifically, enterprise mobility.

4 2 A framework for Responsibly Mobile Introduction In one of the biggest shifts in corporate IT since the 1960s, consumers embrace of mobile technology is forcing companies to rethink their enterprise mobility programs. Increasingly, employees want to engage with consumer grade 1 technology that they can readily obtain in the marketplace and are familiar with thus driving the phenomenon dubbed the consumerization of the enterprise. As part of this phenomenon, organizations must reconsider how they engage with and disseminate information to employees, how they employ technology within the enterprise (i.e., mobile devices), and how they transform their processes (for example, with Mobile First 2 ) to adapt to the new reality. To date, much of the thinking around enterprise mobility has focused on tactical concerns (i.e., calendar, , and contacts), and other point solutions driven largely by tension between business users and IT so-called roadblock issues. 3 Despite these roadblocks, many organizations understand the transformational potential of enterprise mobility and are seeking to accommodate both user and enterprise needs while being responsibly mobile. Being responsibly mobile simply means having a sound enterprise mobility program and framework aligned to the business strategy and its guiding principles. More specifically, responsibly mobile means building a sound strategy and roadmap for devices and apps, having a delivery method that drives effective and secure mobile app development and user experience design (UX), and establishing an operational structure to manage and govern mobile devices and data. These three cornerstones of enterprise mobility strategy, delivery, and operations need to be supported by a proper governance and risk management model. This can help ensure the enterprise maintains an acceptable risk profile, including compliance with privacy and regulatory requirements and protecting data. If done responsibly with strategy, governance, and risk management at its core, mobility can enable game changing, business transformational opportunities for the enterprise. Martin Sokalski, Managing Director, Emerging Technology Risk, KPMG LLP Achieving mobile responsibility requires both a strategic, as well as a tactical or solutions-centric approach. With any disruptive technology, questions abound. How can mobile platforms and apps enable better collaboration, productivity, flexibility, and ease of use? How can mobility improve talent management and retention, build a stronger culture, and enhance the ability to make better business decisions? How can mobility help companies engage with their customers better and gain competitive advantage? There are many benefits to be realized. But how and at what cost? To help answer these questions and help organizations become responsibly mobile KPMG developed the KPMG Enterprise Mobility Framework (KEMF). By providing a holistic view of transformational mobility issues, KEMF can help organizations assess as well as design and implement their mobility programs. In this document, we describe the KEMF s key components and highlight considerations that are essential to unlocking potential benefits of enterprise mobility Mobile First is the idea that web sites should first be designed for mobile devices 3 For example, fast-paced demands from the business are typically greater than maturity of the mobile management tools IT needs; costs for the skills and tools IT needs are greater than return on investment (ROI) for initial mobile app or idea; and frustration from the business outpaces IT s ability to serve business users. 4 Mobile technologies are increasingly maturing as disruptors. These foundations will remain vitally important to further technology progress and will remain a source of enabling innovation. The biggest factors holding back mobile s influence is a persistent challenge security and privacy concerns. Source: KPMG LLP, The Changing Landscape of Disruptive Technologies. Global Technology Innovation Insights - Fall 2014

5 A framework for Responsibly Mobile 3 Common Challenges and Risk Considerations We have had the opportunity to work with organizations of various sizes, complexities, strategies and guiding principles, business models, industries, and risk profiles and appetites. We have also observed organizations with varying levels of capabilities and maturity in guiding and governing people, processes, and technology. Some of these organizations have embraced mobile programs proactively, aligning with guiding principles (i.e., talent management/retention, efficiency/ productivity, competitive advantage, etc.), strategic planning (business process enablement, executive reporting, field enablement, etc.), and their technology capabilities. Others have been reactive, succumbing to pressures of employees or executives or trying to establish a layer of control over mobile devices that have snuck in through the back door. Regardless of how mobility becomes a topic of discussion at the board, executive, or management level and regardless of a typically comprehensive understanding of opportunities and potential benefits organizations regularly struggle to answer the following questions: Strategy and target operating model/roadmap How do we ensure that our mobile program is aligned with the business strategy and operates in a way to maximize value to our stakeholders? Governance and compliance How do we help ensure that our mobile program is effectively governed and designed to adequately consider legal, HR, privacy, and regulatory nuances? Information security How do we adequately protect corporate data on mobile devices? Operations How do we manage mobile devices from procurement through disposition? Use cases and business transformation What solutions do we deploy to the mobile devices that will have the greatest impact and benefit to the business? User experience How do we create an engaging user experience while maintaining a proper security profile and required performance levels? Many attempt to address these challenges, but their efforts are often siloed and fragmented. For example, some will focus all efforts on securing data on mobile devices, but fail to consider business use cases, user experience, or alignment to a broader enterprise strategy. Others focus on supporting every mobile platform available or attempt to deliver all content to the mobile device without enough consideration for information security risks. It is also common for organizations to roll out mobile solutions, but pay too little attention to HR, legal, privacy, and regulatory matters. Lacking in these examples is a comprehensive and integrated mobile strategy and the right balance between managing risk while optimizing potential rewards of mobility.

6 4 A framework for Responsibly Mobile Defining the KPMG Enterprise Mobility Framework KPMG developed the KPMG Enterprise Mobility Framework (KEMF) based on this common set of challenges. KEMF can help organizations develop and implement their mobility programs and strike the right balance between risks and rewards. KEMF provides an integrated view of tools, governance, and oversight, not just technology; encompasses demand management, app governance, content delivery, and compliance; and ultimately facilitates alignment of an enterprise mobility program with business strategy. KEMF can also be used to perform a current state assessment including current capabilities and maturity and gap analysis and facilitates the development of an integrated enterprise mobility strategy, target operating model, and roadmap. Figure 1: KPMG Enterprise Mobility Framework (KEMF) Analytics & Optimization Compliance Devices PROGRAM MANAGEMENT OPERATIONS Apps STRATEGY GOVERNANCE & CENTER OF EXCELLENCE DELIVERY Roadmap User Experience Design Development Security, Privacy & Managed Mobility Services lity Assurance BUSINESS TRANSFORMATION QuaTesting & SOURCE: KPMG Business Transformation According to a 2014 survey by KPMG, 5 a vast majority of companies are in some phase of transforming their business model. These transformations are often driven and enabled by technology, including the proliferation of mobile devices. As mobility continues to expand the range of possibilities within functional process layers (i.e., making critical information available in real time), organizations are rethinking how to best maximize such benefits. Even though technology is often the enabler of business transformation, for such transformation to be successful, there needs to be a myriad of well-planned and designed considerations around strategy, people and change, processes, risk, and technology. PROBLEM: Too focused on technology, not integrated with other functions PROBLEM: Managing mobility as a series of independent projects RESULT: Missed opportunity to transform and drive business value Tactical and point solutions Poor user experience and unrealized benefits RESULT: Operational inefficiencies Information security and privacy lapses Compliance and reputational exposures 5 BusinessTransformationandtheCorporateAgendaDec13.pdf

7 A framework for Responsibly Mobile 5 Governance and Center of Excellence Mobile governance defines the standards, methods, approaches, and guiding principles of an enterprise mobility program. If designed appropriately, it can be very effective at breaking down traditional organizational roadblocks that can prevent programs from achieving their goals and objectives as the organization progresses down the mobile path. In many organizations, adoption of mobile technology has followed a series of back-and-forth interactions between the business and IT as shown below. Figure 2: The mobile journey 6 A mobility center of excellence (MCoE) can enable and facilitate an integrated and coordinated approach to decisions related to business and technology matters, including use cases, legal and HR compliance requirements, technical platforms and architectures, and awareness and training. While governance is the what that is decided, defined and documented, an MCoE is the how to put it in action. GOVERNANCE MODEL AND MOBILE COE Mobile as an ongoing enabler of business transformation BUSINESS REQUIREMENTS & DESIRES GETTING STARTED , contacts & calendar BYOD ACCESS TO CONTENT Documents Reports Sales decks Collateral FIRST MOBILE APP Customer-facing Internal LoB enablement SECURE DEVICES MDM container Policies Security tools CYOD programs APP PIPELINE Suite of LoB apps Mobile access to business systems Mobile enabled workflow ACCESS TO THE ENTERPRISE MDM+ Mobile VPN Cloud storage Third party apps 6 LoB: line of business ENABLE THE BUSINESS Native vs. Web App containers Back-end integration MAM/distribution Apps security Privacy policies MDM: mobile device management Mobile VPN: mobile virtual private network INDUSTRIALIZE MOBILITY Standards Code re-use Mobile analytics Data mgmt Methodology Alliance mgmt Additional tools IT TOOLS, PROCESSES, DECISION & PROJECTS MAM: mobile application management CYOD: choose your own device BYOD: bring your own device

8 6 A framework for Responsibly Mobile Strategy A mobile strategy is a prerequisite for the delivery and operations of a mobile program, but organizations often struggle even to articulate one. Mobility may reside under a broader IT strategy or not exist at all. We find mobile strategies in various stages of development as organizations wait to see how to respond to changes in consumer markets, including vendors, providers, platforms, and technologies. Organizations must ensure that mobile programs are well aligned with the broader IT and business guiding principles and strategy. This alignment will provide an effective framework for the organization to consider all of the major issues, highlight interdependencies, and facilitate decision making when there are conflicting tradeoffs. It will also facilitate a cohesive and integrated approach supported by a well designed operating model, governance structure, and a roadmap. The following are some examples and key considerations for both device and application strategies: Devices Deciding which devices, platforms, and carriers the organization should deploy or support is paramount to the success of any mobile strategy. Each device strategy presents different risks to different organizations. There is no one-size-fits-all approach. The decision should not be based strictly on infrastructure, security, or cost, though these are important factors. Devices should be continuously reevaluated to ensure that supported devices align with strategic objectives, user expectations, information security requirements, regulatory requirements, and a rapidly changing device landscape. For any enterprise mobile deployment, a device strategy is the foundation that anchors mobile apps and operations activities, and ties mobile initiatives to business requirements and goals. Knowing what devices the organization is supporting influences how it defines, designs, and builds applications. Key decision makers for devices and supporting infrastructure should be part of the governance and/or MCoE functions. Apps Apps, both internally and externally developed, offer increased mobile functionality and opportunities for business process enablement. Many organizations wrestle with a heavy demand for apps but lack an effective process for evaluating and qualifying these demands. They may jump head first into mobile and wind up with redundant functionality and the daunting task of supporting and updating apps to stay current with mobile OS releases. In some cases, key business apps are not supported through new OS releases, preventing users from updating and exposing the organization to security vulnerabilities. Apps strategy needs to include the prioritization of app ideas and opportunities. The focus should be on relevant and useful apps those that will optimize business processes rather than apps for apps sake. An app strategy should also be part of a larger mobile strategy. Enterprise application management cannot be effective unless it is appropriately aligned with mobile device and infrastructure management to maximize return on mobility investment. For example, app decisions should consider existing back-end systems and security layers. Assessing the organization s risk profile relative to mobile is key to ensuring apps appropriately safeguard the organization from security breach.

9 A framework for Responsibly Mobile 7 It s time the enterprise learned to become more consumer grade. Joel Osman, Managing Director, Digital and Mobile, KPMG LLP Key questions such as what type of data is permitted for distribution in mobile apps, what data must be retained for legal purposes, and what data can be stored offline all must be considered in a successful mobile strategy. Roadmap A mobile strategy roadmap combines all the components of enterprise mobile enablement into an actionable plan and an operating model. This plan is based on where the enterprise is and what is required to reap the real benefits of mobile in a designated timeframe with milestones and deliverables. A roadmap strategy evaluates an organization s mobile maturity, device and data management needs, potential and existing mobile solutions, mobile requirements, governance, and user experience. The outcome is a defined approach and timeline to guide how the enterprise should invest its focus, time, money, and resources. Some of the benefits of a mobile roadmap include an improved ROI on mobile implementations (due to upfront planning around mobile governance), identification and solution analysis of highest impact opportunities, and improved quality and reduced inefficiency (through evaluation and planning of how, when, and where resources should be invested). Delivery The delivery of an enterprise mobility program consists of app development, user experience design, and testing/quality assurance. Development As enterprise mobility programs continue to evolve and mature, so do the use cases and applications that are being developed within the enterprise. The mobile workforce continues to push not only for more data content and processing on mobile platforms, but as importantly, for better experience in engaging with that content. Whether it is executive reporting, field enablement, utility, productivity, or collaboration use cases, the user expects there to be an app for that. As a Forrester report put it, The denizens of this new world are empowered digital natives, brazenly challenging business conventions for where and how work gets done, and challenging IT to find new ways to deliver security and freedom. 7 Furthermore, there is a direct correlation between an organization s ability to recruit and retain talent and employees positive experience interacting with the enterprise data and technology. 8 Many organizations decide to take the development challenge head-on and turn use cases into tangible mobile apps in-house; others outsource the task to third parties. Whichever approach an organization chooses, it must be supported by clearly defined governance, requirements, and risk and usability considerations. Specifically, apps must be developed according to clearly articulated use cases and business and technical specifications and built using secure coding practices, while taking into account user experience. Whereas mobile apps for consumers are designed primarily to be easy to use and visually pleasing, enterprise apps must balance user experience with appropriate controls to protect sensitive data and resources. A common challenge that organizations face is to embed seamless security controls while maintaining this positive user experience. Unless the app is easy to use, no one will use it, and the benefits to the organization will be lost. Should the organization support every device, carrier, and OS available in the market through a bring your own device (BYOD) program? Or should it support only one device, OS, and carrier in the form of a fully managed, company-owned and -operated model? 7 David K. Johnson and Michele Pelino Forrester

10 8 A framework for Responsibly Mobile Unless the app is easy to use, no one will use it, and the benefits to the organization will be lost. User Experience Design Expectations of employees are always changing, fueled by the knowledge economy and the consumerization of the enterprise. Businesses must adapt to changing market conditions and continue to be agile in how they deliver tools and solutions to their users. Employees are more vocal about the technology they want to interact with, expect consistency in design and functionality, and look for easier ways to get work done. In this environment of expectations and demands, enterprises are challenged to adapt quickly enough to keep employees engaged in their jobs. As a result, enterprises attempt to re-create experiences and levels of engagement common to consumer apps, effectively setting a new bar for enterprise app design called consumer grade. Organizations are beginning to understand this concept, and user experience design continues to move up the priority list. Testing/QA Whether mobile application development takes place internally or is sourced to third-party vendors, it is important to set and maintain a level of governance, quality, and security over the development process. To ensure successful execution and proper risk mitigation, development efforts should align closely with the enterprise development methodology. Proper consideration should be given to the integration of mobile apps and secure back end of enterprise systems (i.e., ERP, CRM, legacy systems, etc.). This requirement poses a challenge for many application development functions not only around user experience, but also security, functionality, integration, and data management. To mitigate risks associated with mobile applications, a rigorous application development methodology should be utilized supported by secure coding practices, as well as an effective quality assurance (QA) function and issue resolution process. An organization must develop a sound mobile application testing and monitoring strategy not only for development, deployment, and management of internal applications, but also to determine what external applications are to be allowed on enterprise devices to minimize security and privacy exposures. Operations The operations of an enterprise mobility program represent the ongoing management and maintenance of the program once it has been deployed. It consists of Managed Mobility Services (MMS); security, privacy and compliance; and analytics and optimization. Managed Mobility Services MMS represents the core of the operations function, which is the management of the physical devices, application, data, and all supporting processes. MMS considers business and financial operations associated with device management and helps determine operational staffing needs, roles, and responsibilities, as well as a variety of policies and processes. The MMS component of the KEMF consists of a number of process elements, which may vary by organization or deployment model (see Figure 3). The effectiveness and efficiency of many enterprise mobility programs are directly affected by the design and implementation of the MMS processes. For example, we found that many organizations are not able to realize their ROI due to ineffective processes around device procurement, provisioning, and poor financial management (i.e., carrier plan contracting and user reimbursement plans). The key is to define enterprise-wide mobile policies and processes that are conducive to enabling a broader IT and business strategy with governance and risk management at the foundation. Security, Privacy & Compliance In this new environment, vital business data now transcends the bounds of the corporate network, presenting new challenges not only to deliver relevant data to decision makers but also to ensure that same data is available only to its intended recipients. Mobile devices and apps now exist in a much more unbounded and mobile state. Evolving mobile malware, combined with relatively low user awareness of mobile risks, can have a significant impact on an enterprise s information protection profile. Furthermore, depending on the nature of mobile app use cases and data, there may be regulatory compliance implications, including Health Insurance Portability and Accountability Act (HIPAA), Financial Industry Regulatory Authority (FINRA), Securities and Exchange Commission (SEC), or other privacy regulations or laws.

11 A framework for Responsibly Mobile 9 Figure 3: MMS process elements PROGRAM MANAGEMENT Apps Devices Roadmap STRATEGY User Experience Sales & Procurement Provisioning & Activation Configuration & Deployment Analytics & Optimization Mo Managed bility Services OPERATIONS GOVERNANCE & CENTER OF EXCELLENCE Security, Privacy & Compliance DELIVERY lity Assurance BUSINESS TRANSFORMATION Qua Testing & Design Development End-of-life/ Recycle Mobile Device Management Replacement MANAGED MOBILITY SERVICES Mobile Application Management Repair Service Desk Mobile Financial Management Enterprise mobility is not just technology, but a comprehensive program spanning people, processes, and technology. Likewise, data security controls can t be applied just to the device; they must also be applied to applications, data, network, people, and processes through an integrated security governance program. Furthermore, when device security, network security, and app security are not properly aligned and coordinated, they will all come crashing down on the user experience. As a starting point, some key questions need to be answered: How will the company protect the devices and data against unauthorized use and access? How will the company ensure compliance with regulatory and privacy requirements? What data is to be protected at the device and mobile application level? How will the devices be managed, monitored, and wiped if necessary? What governance, policies, and acceptable use and awareness programs do we have in place? What is the impact to the organization if the data on these devices were lost or stolen? Does the organization have a process to help ensure continued compliance with existing or new regulations and security requirements? Analytics and Optimization As part of the trend of enterprise consumerization, organizations typically track downloads, usage, adoption, engagement, and uptake of consumer mobile apps. Similar metrics are required for enterprise apps in order to understand their value and ultimate ROI within the organization. These metrics can help the organization meet and exceed its strategic priorities and drive measureable and continuous improvement and thereby improve adoption, employee engagement, technological advances, process improvement, and efficiency.

12 10 A framework for Responsibly Mobile Balancing Opportunity and Risk Various stakeholders view mobility device risks and opportunities differently. Ultimately, they will agree that mobility is here to stay and that it is transforming the way the organization does business and how it engages with its work force and customers. Understanding the risks and opportunities from the point of view of each stakeholder is critical to a successful and cohesive mobile strategy and risk management. Among the executive suite, CIO, CISO, OGC, audit executive, risk officer, compliance, functional business leader like HR, engineering, or marketing, and users, points of view will differ. For example: Common Benefits User/Consumer Engagement and Behavior, Improved Efficiency and Accuracy, Cost Management, Collaboration, Productivity, Process Automation, and Embracing Disruptive Technology and Innovation Executive Shorter return on investment Defined competitive advantage Easy access to key business information and performance metrics Customers On-demand access to information Customer service/help desk automation Ops and IT Mobile First or streamlined development, delivery, and presentation of content Streamlined processes and lower infrastructure and device costs Legal/Risk/HR/Compliance Maintaining employee privacy Ability to protect information at network, device, application and data layers Business Functions and Users Variety of use cases and streamlined business processes Ubiquitous connectivity and access Field and sales force enablement Business transformation and new value channel Enhanced user and customer satisfaction and engagement Anywhere engagement with customers Key client reports and metrics available anytime/anywhere Driving value through ease of use and ubiquitous access Ability to manage and govern mobile devices and apps Simplify remote access needs for knowledge workers Ability to govern and monitor compliance Comprehensive view of mobile risk Stronger security and reputational posture through use of secure coding, testing, and monitoring of apps Business Intelligence driven by data and analytics Talent management (recruiting, retention and satisfaction) Enhanced staff engagement and productivity Business Intelligence driven by data and analytics Talent management (recruiting, retention, and satisfaction) Enhanced customer satisfaction and engagement Shorter return on investment Ability to protect information at network, device, application, and data layers End-user licensing agreements Ability to comply with regulatory, legal and HR obligations Flexible work environment Improved organizational culture and capabilities Enhanced engagement through intrinsic motivational design

13 A framework for Responsibly Mobile 11 Common Risk Considerations User/Consumer Engagement and Behavior, Efficiency and Accuracy, Cost Management, Collaboration, Productivity, Process Automation, and Disruptive Technology and Innovation Executive Organizational Reputation Financial and ROI cycles Regulatory compliance Customers Privacy- PII and client confidential data Inability to access information in consumable format Ops and IT Tool/vendor selection Usability and experience Maintenance and support Privacy and security Legal/Risk/HR/Compliance Use of non-sanctioned devices Ineffective monitoring and policy enforcement Inconsistencies in mobile platforms and security capabilities No segregation of corporate and personal data Business Functions and Users Intellectual property Change enablement and adoption rates Mobile strategy (mis)alignment with business strategy User and consumer engagement Governance and organization Poor user experience Addressing the trust gap Apps built/delivered as point solutions Functionality delivered not aligned with organizational goals Implementation/management cost Non-company-sanctioned apps (i.e. rogue apps) Enforcement of acceptable user policies Lack of data loss prevention (DLP) on mobile devices Device loss/theft Secure coding practices Mobile app management and governance Addressing the trust gap Policies and procedures Acceptable use Missing the opportunity Keeping up with pace of change Inability to obtain key reports anytime/anywhere Poor customer satisfaction and engagement Managed services and service levels Device, app, and user governance and controls Country- and region-specific laws and regulations E-discovery, data leakage, compensation, and acceptable use Internal policies and procedures Program governance and lines of defense Exposure of sensitive data Inefficiency and poor user experience

14 12 A framework for Responsibly Mobile Conclusion The innovation rate in mobile devices, social software and cloud computing is accelerating faster than the enterprise adoption rate, and consumer mobile applications are setting the standard for enterprise apps. IT organizations that fail to adapt to this new reality may lose their relevance in the era of pervasive mobility. Organizations that continue down the path of tactical solutions may be exposing themselves to risk, but more importantly, are simply missing an important opportunity. Your organization may already have a mobile strategy of sorts, but if it is overly segmented, not aligned with business strategy, or blind to key requirements or risks, it will likely not be successful. Mobile devices are already transforming organizations and entire industries. Companies are adopting reasonable approaches that aim to mitigating risks of mobile while seizing its opportunities. It all begins with a framework such as the KEMF. An effective enterprise mobility program should consist of all the elements contained within KEMF. At the same time, an organization s mobile program will be based on its business strategy, industry, risk appetite, and current capabilities and maturity. That s why a current state assessment and a gap analysis utilizing the KEMF is the place to start. The findings can drive an effective target operating model and implementation roadmap. Becoming responsibly mobile in three steps Using the KEMF, conduct an assessment of your mobility program to determine your level of capabilities and maturity and alignment with your business goals Build out your mobility program and roadmap by addressing all the elements of the KEMF and using the insights gained from your assessment Adopt the consumer grade standard for all mobile apps About KPMG KPMG s Emerging Technology Risk Services can help organizations become responsibly mobile, social, and in the cloud. We work with organizations to analyze emerging technology risks and issues including IT strategy, operating models, privacy, security, governance, regulatory and compliance. We focus on the business impact of technology, and we are not tied to any hardware or software suppliers. As a result, our advice is objective and geared to the specific needs of each client. KPMG s IT Advisory team is a trusted advisor to the Boards of some of the world s largest multinational organizations. We operate in the developed markets and in the key emerging economies of Central and Eastern Europe, Central and South America and Asia Pacific. We offer the following services to help your organization become more responsibly mobile: Assessment of enterprise mobility operating model using the KEMF Mobile benchmarking and capability and maturity assessments Risk services relating to mobile program and device enablement (security, privacy and compliance, device management, program governance/mcoe, etc.) Risk services relating to mobile applications (secure development, security, privacy and compliance testing, app portfolio management and governance) Mobile tools and solution design and implementation (BYOD/ CYOD, MDM, MAM, etc.) Design and implementation of enterprise managed mobility processes and services from device procurement through disposition Design and development of mobile apps

15 A framework for Responsibly Mobile 13

16 KPMG would like to thank the following contributors: Phillip Lageschulte, and Joel Osman. Contact us Phillip Lageschulte Global Leader Emerging Technology Risk T: E: Martin Sokalski Managing Director Emerging Technology Risk T: E: Joel Osman Managing Director Digital and Mobile T: E: kpmg.com Some or all of the services described herein may not be permissible for KPMG audit clients and their affiliates. The information contained herein is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavor to provide accurate and timely information, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. No one should act on such information without appropriate professional advice after a thorough examination of the particular situation KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative ( KPMG International ), a Swiss entity. All rights reserved. Printed in the U.S.A. The KPMG name, logo and cutting through complexity are registered trademarks or trademarks of KPMG International. NDPPS