---
title: "Purpose"
source: Open Source SOC Documentation
source_url: https://github.com/madirish/ossocdocs
licence: MIT
domain: engineering
subdomain: soc-docs
date_added: 2026-04-25
---

## Purpose
This SOP outlines the standardized response process for incidents involving potentially compromised mobile devices,  including phones and tablets. Mobile devices often contain access to sensitive corporate resources and personal data; therefore, rapid containment, proper evidence preservation, and coordinated remediation are essential to mitigate risk and support forensic investigations where required.  Mobile devices frequently run proprietary operating systems or otherwise preclude the installation of Endpoint Detection and Response (EDR) tools so the Security Operations Center (SOC) may have to work with the Mobile Device Management (MDM) team to respond or investigate the device.  The Digital Forensics team may also be called upon to investigate compromised devices to determine root cause, exposure, and develop mitigation.

## Scope
This SOP applies to all members of the Security Operations Center (SOC), Mobile Device Management (MDM) teams, IT support staff, and Digital Forensics teams. It governs incidents involving any mobile device (corporate-managed or BYOD) that has access to corporate systems, including but not limited to email, document repositories, internal applications, and third-party services.

Incident triggers include but are not limited to:
- User-reported suspicious activity on a mobile device
- Alerts generated by MDM tools
- Indicators from threat intelligence, SIEM, network traffic, DNS activity, or endpoint telemetry
## Prerequisites
Before executing this SOP, the following must be in place:

- Operational MDM system, or comparable system, with remote wipe and device isolation capabilities
- Conditional access enforcement capabilities for corporate systems
- Established communication channels with IT, forensics, and the user community
- Access to current device inventory and user identity mapping
- Forensic handling protocols and trained staff (if forensic acquisition is required) and mobile device forensics collection software and/or hardware
## Roles and Responsibilities

| Role                   | Responsibility                                                                                                                                                                                                                          |
| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SOC Analyst            | Triage alerts and initiate incident response.Coordinate with user, IT, and MDM teams.Document all actions taken in the case tracking system.Initiate containment and recovery actions.                                      |
| Digital Forensics Team | Advise on forensic preservation steps.Receive and process devices requiring forensic examination.Maintain chain of custody and analysis records.                                                                                |
| MDM/IT Team            | Enforce device restrictions or execute remote wipe.Support user re-enrollment of cleaned or new devices.Assist in unlocking the device if needed for forensics.                                                                 |
| End User               | Cooperate with SOC/IT instructions.Place the device in airplane mode if requested.Provide unlock code if needed and assist in device shipment or handoff.Follow post-incident recovery guidance, including password resets. |
| SOC Manger             | Approve incident close out.Collect metrics supporting/demonstrating mobile incident response.                                                                                                                                       |

## Procedure Steps
### **1. Triage and Initial Containment**
1.  Receive and validate alert (user report, MDM alert, SIEM, etc.).
2. Identify the user and device involved.
	1. If VIP refer to [[POL - VIP Users and White Glove]]
3. Determine device platform, ownership (BYOD vs corporate), and current access to corporate systems.
4. Enforce conditional access block to restrict device access to email, document repositories, payroll, HR, and other sensitive systems.
5. Notify the user of suspected compromise and initiate containment actions.
### **2. Forensic Determination**
1. Determine whether **forensic examination** is required
	1. If **yes**, proceed to Section 3
	2. If **no**, skip to Section 4 for wipe and recovery.
### **3. Forensic Preservation**
1. Instruct the user to:
	1. Place the device in airplane mode.
	2. Leave the device powered on and plugged in.
	3. Avoid interacting with the device.
 2. If device acquisition is remote:
	1. Ask the user to connect the phone to a battery backup.
	2. Ship the device securely to the forensics team with appropriate packaging.
 3. If the device is local:
	1. Instruct the user to deliver the device to the forensics team in person.
 4. Once the device is received begin chain of custody procedures upon receipt.
 5. Obtain unlock code from user or MDM admin if needed for forensic access.
### **4. Non-Forensic Recovery Path**
1. Execute one of the following, in coordination with IT/MDM:
	1. Remote wipe via MDM
	2. Instruct user to perform a factory reset.
		 1. Instruct the user to re-enroll the device in MDM following reset or to provision a new device.
 2. Reinstate conditional access upon:
	1. Successful MDM enrollment.
	2. Validation that the device is clean and compliant.
### **5. User Communication and Post-Incident Actions**
1. Advise the user to:
	1. Reset all corporate passwords (e.g., AD, Office 365, VPN).
	2. Avoid restoring from backup if there’s a chance backups are compromised.
	3. Reset passwords to personal services accessed on the device (e.g., banking, healthcare, social media).
 2. Provide user with educational materials on avoiding future mobile threats (e.g., phishing apps, vishing, scam calls, installing unfamiliar apps, jailbreaking, etc.).
### **6. Documentation and Closure**
1. Document the following in the case management system:
	1. Timeline of detection and response actions.
	2. User communications.
	3. Containment and remediation steps.
	4. Final disposition of the device.
2. Document forensic findings, if applicable.
    1. Generate after-action report if warranted by incident severity or client request.
    2. Close the case with final approval by SOC lead or manager.
3. Submit any observable to the Threat Intelligence team for tracking
