Sophos Mobile Control
13 Compliance rules
With compliance rules you can:
Allow, forbid or enforce certain features of a device.
Define actions that are executed when a compliance rule is violated.
You can create various sets of compliance rules and assign them to device groups. This allows you to apply different levels of security to your managed devices.
Tip: If you are planning to manage both corporate and private devices, we recommend that you define separate sets of compliance rules for at least these two device types.
13.1 Create compliance rules
To create a set of compliance rules:
1. On the menu sidebar, under CONFIGURE, click Compliance rules.
2. On the Compliance rules page, click Create compliance rules.
3. Enter a Name and an optional Description for the new set of compliance rules.
The Compliance rules page contains individual tabs for the device platforms that are activated for the customer. Repeat the following steps for all required platforms.
4. Make sure that the Enable platform check box on each tab is selected.
If this check box is not selected, devices of that platform will not be checked for compliance.
5. Under Rule, configure the compliance criteria for the particular platform.
Each compliance rule has a fixed severity level (high, medium, low) that is depicted by a blue icon. The severity helps you to assess the importance of each rule and the actions you should implement when it is violated.
For a description of the available rules for each device type, click Help on the system information bar.
24
startup guide
6. Under If rule is violated, define the actions that will be taken when a rule is violated:
Option
Deny email
Description
Forbid email access.
This action can only be taken when you use the Sophos Mobile
Control EAS Proxy server.
See the Sophos Mobile Control super administrator guide.
Lock container
Deny network
Disable the Sophos Secure Workspace and Secure Email apps. This affects document, email and web access that is managed by these apps.
This action can only be taken when you have activated an SMC
Advanced license.
This option is only relevant for Android and iOS devices.
Forbid network access.
This action can only be taken if the super administrator has activated
Network Access Control.
See the Sophos Mobile Control super administrator guide.
Notify admin
Transfer task bundle
Send compliance emails to selected recipients.
The list of recipients and the time schedule is specified collectively for all sets of compliance rules that you create. See the instructions later in this section.
Transfer a specific task bundle to the device.
We recommend that you set this to None at this stage. For further information, see the Sophos Mobile Control administrator help .
Important: When used incorrectly, task bundles may misconfigure or even wipe devices. To assign the correct task bundles to compliance rules, an in-depth knowledge of the system is required.
7. When you have made the settings for all required platforms, click Save to save the set of compliance rules under the name that you specified.
The new set is displayed on the Compliance rules page.
8. If you have selected the Notify admin action for one of the compliance rules, click Compliance
email settings to specify the recipients that will receive compliance emails and the times when compliance emails are sent.
You can specify the recipients either by entering the name of an administrator or by entering a valid email address.
Note: These are common settings that apply to all compliance rules that have a Notify admin action.
25
Sophos Mobile Control
9. Click Save to save the compliance email settings.
To make use of a set of compliance rules, you assign it to a device group. This is described in the next section.
26
