MOBILE DEVICE POLICY Purpose: This policy has been issued to establish uniform rules that govern how

individuals request, receive and utilize hand-held mobile devices (cell phones, smart phones, tablets, etc), to ensure consistent, equitable and cost effective practices throughout Company and to inform mobile device users and Managers of their authority and responsibilities. This policy applies all hand-held mobile devices that access Company resources. It does not address laptop computers or other full-function personal computers as those devices are covered under other policies such as the Computer Resources and Data Security Policy. Policy: This policy applies to all mobile device users accessing Company resources or with service plans paid for by the Company. The repair and discipline provisions of this policy are subject to collective bargaining for those employees covered by a union contract. The Company provides mobile equipment and service to Eligible Individuals in order to enable efficient and effective communication with Company personnel, customers, and suppliers. All Eligible Individuals are required to use the Companys preferred suppliers for mobile services. Exceptions will be made solely due to coverage issues and with appropriate Vice President level approval, corporate mobile device users require Department Head Vice President and field mobile device users require Area Vice President. Corporate IT and Procurement are responsible for establishing preferred supplier relationships, programs, and equipment standards. All mobile devices accessing Company resources or with service plans paid for by the Company, both Corporate Devices and Personal Devices, are subject to (without notice) usage inspection, and reporting by designated Company representatives.

Eligibility: Attached to this policy is a Wireless Demand Management Matrix. This matrix provides Job Profiles by department and the wireless equipment and functionality that are authorized for each Job Profile. These profiles, which match individual roles to appropriate devices, plans, and features, identify the wireless capabilities minimally required to fulfill an individuals business responsibilities. These profiles are consistent with industry best practices, and are subject to exception only as described in this policy. Standard Company applications (Nextmail, GPS, SMS (text) Snapshot, AirClic, etc) are accepted upon appropriate Vice President level approval. All non-standard applications are prohibited, unless approved

by the Vice President, IT Infrastructure. Definitions: Eligible Individual: Is anyone approved/authorized under this policy for a Company provided device with mobile email/data access. Ineligible Individual: Is anyone not approved/authorized under this policy for a Company provided device for mobile email/data access. Corporate Device: Is a Company asset with a Company approved and Company paid service plan provided by the Company preferred vendor, under a Company account. Standard Corporate Device: Is a Company asset purchased by the Company. The service plan is

a Company approved and Company paid plan provided by the Company preferred vendor, under a Company account.
Upgraded Corporate Device: Is a Company asset where the mobile device user has paid the cost of upgrading from the Standard Corporate Device. The service plan is a Company approved and

Company paid plan provided by the Company preferred vendor, under a Company account.
Personally Supplied Corporate Device: Is deemed to be a Company asset purchased by the mobile device user and transferred to the Company preferred vendor. The service paln is a Company approved and Company paid plan provided by the Company preferred vendor, under a Company account. Personal Device: Is an individuals personally owned asset, the purchase pr ice of which has not been paid nor reimbursed in whole or in part by the Company. The service plan can be provided by any vendor of the individuals choice. All service, maintenance, and repair costs are the responsibility of the individual and no costs are reimbursable or paid for by the Company. Frequent Travelers and Mobile Workers: In the event an individual requests a mobile device or functionality that is not designated for his or her position under the Wireless Demand Management Matrix, the individual may request the additional wireless functionality under the criteria of "Frequent Travelers and Mobile Workers". The individuals appropriate Vice President level manager may approve an exception by responding to a written or email request. The approving Vice President should consider if alternatives described below may provide sufficient functionality. For administrative ease, the approving Vice President may designate individuals to process and approve on his behalf. However, it is noted that the approving Vice President is ultimately accountable for his

Department's or Market Area's compliance with the Mobile Device Policy and expenditures. Definition: Frequent Traveler An individual who is away from his/her designated office/work station at least 25% of the work days in a quarter. (i.e. Equivalent to 15 days or more for the quarter.) Definition: Mobile Worker An individual whose duties require him to consistently work at locations outside an office or work station environment. In addition, the individual must have immediate mobile device access to perform his job duties.

Mobile Email/Data Access Device Users: Eligible Individuals: Anyone approved/authorized under this policy for a Company provided device with mobile email/data access is eligible for one Company provided Corporate Device as defined in the Mobile Email/Data Access Device Options section of this policy. With appropriate Vice President level approval, the individual may also request mobile email/data access for a second device under the terms defined in this policy for a Personal Device. Alternatively, an individual may choose two Personal Devices, as defined in this policy, subject to appropriate Vice President level approval. The Company does not provide reimbursement for any equipment or recurring service/usage charges for Personal Devices.

Ineligible Individuals: Anyone not eligible for a Company provided device for mobile email/data access under this policy may request access, subject to appropriate Vice President level approval, for up to two Personal Devices, as defined in this policy. The Company does not provide any reimbursement for any equipment or recurring service/usage charges for Personal Devices. Hourly Workers: For compliance with employment laws and regulations, hourly/non-exempt workers, except for roles specifically identified in the Wireless Demand Management Matrix, are restricted from mobile device access to the Companys data network. This includes, but is not limited to, accessing email, calendar, contacts, and Visor. These workers do not qualify for any of the

mobile voice or email/data device options outlined in this policy. Any hourly/non-exempt workers with special requirements may receive an exception as outlined in this policy, subject to appropriate Vice President level approval, and qualify for the device options as outlined for a mobile email/data access Eligible Individual.

Mobile Email/Data Access Device Options: Standard Corporate Device: The Company will supply a Standard Corporate Device to any Eligible Individual, as defined in this policy. A Standard Corporate Device is a Company owned asset, purchased by Company. The service plan will be a Company approved standard plan provided by the Company preferred vendor, under a Company account. The Company will pay for the recurring service/usage charges and the phone number will be considered a corporate phone number owned by Company. The Company, at its sole discretion, will identify and define the Standard Corporate Device. These standards are subject to change at any time without notice. The individual is responsible for replacement of any lost, stolen or broken device, if the loss or damage involves a violation of policy or negligence, and no replacement costs will be reimbursable or paid for by the Company, as allowed by state law. If a device is required to perform the duties of the position, a Standard Corporate Device or available surplus device will be provided as a replacement. If the device is eligible for a vendor provided replacement or upgrade per the terms of the service contract, for no cost and without incurring early termination penalties/fees, the appropriate Vice President level manager may approve the vendor supplied replacement under the terms of this policy. Upgraded Corporate Device: An Eligible Individual, as defined in this policy, may choose, with appropriate Vice President level approval, to upgrade the Standard Corporate Device to an alternative device included on the Company Approved Mobile Devices list and available through the Company preferred vendor. Any and all costs associated with the upgrade are the responsibility of the individual and not

reimbursable by the Company. An Upgraded Corporate Device is a Company owned asset and subject to the same terms and conditions associated with all other Corporate Devices, regardless of the individual paying the upgrade costs. The service plan will be a Company approved standard plan provided by the Company preferred vendor, under a Company account. The Company will pay for the recurring service/usage charges and the phone number will be considered a corporate phone number owned by Company. The individual is responsible for replacement of any lost, stolen or broken device, if the loss or damage involves a violation of policy or negligence, and no replacement costs will be reimbursable or paid for by the Company, as allowed by state law. If a device is required to perform the duties of the position, a Standard Corporate Device or available surplus device will be provided as a replacement. If the device is eligible for a vendor provided replacement or upgrade per the terms of the service contract, for no cost and without incurring early termination penalties/fees, the appropriate Vice President level manager may approve the vendor supplied replacement under the terms of this policy. The Company, at its sole discretion, will identify and define the approved mobile device options and update the Company Approved Mobile Devices list, as required. Personally Supplied Corporate Device: An Eligible Individual, as defined in this policy, may choose, with appropriate Vice President level approval, to supply a personally owned device and still have the Company pay the recurring service/usage charges. This device must be included on the Approved Mobile Devices list and must be eligible for service on the Company preferred vendor. The device cost and any costs associated with migrating the device to a Company account with the preferred vendor are the responsibility of the individual and not reimbursable by the Company. A Personally Supplied Corporate Device will be deemed to be a Company owned asset and subject to the same terms and conditions associated with all other Corporate Devices, regardless of the individual paying the purchase cost. The service plan will be a Company approved standard plan provided by the Company preferred vendor, under a Company account. The Company will pay for the recurring service/usage charges and the phone number will be

considered a corporate phone number owned by the Company. The individual is responsible for replacement of any lost, stolen or broken device, if the loss or damage involves a violation of policy or negligence, and no replacement costs will be reimbursable or paid for by the Company, as allowed by state law. If a device is required to perform the duties of the position, a Standard Corporate Device or available surplus device will be provided as a replacement. If the device is eligible for a vendor provided replacement or upgrade per the terms of the service contract, for no cost and without incurring early termination penalties/fees, the appropriate Vice President level manager may approve the vendor supplied replacement under the terms of this policy. Personal Device: An Eligible Individual or Ineligible Individual may choose, with appropriate Vice President level approval, to use a Personal Device for mobile email/data access. A Personal Device is an individuals personally owned asset, the purchase price of which has not been paid nor reimbursed in whole or in part by the Company, and all service, maintenance, and repair costs are the responsibility of the individual. The individual is responsible for replacement of any lost, stolen or broken device and no costs are reimbursable or paid for by the Company. The device must be included on the Company Approved Mobile Devices list and the individual must sign a Company Mobile Device Policy Acknowledgement accepting all the terms and conditions outlined in this policy, including the right of the Company to manage and wipe the device as necessary, potentially erasing personal data, information, and records including files, software, music, and photos. A Personal Device will remain a personally owned asset of the individual. The service plan can be provided by any vendor/carrier as chosen by the individual with the phone number belonging to the individual. Any and all recurring service/usage charges are the responsibility of the individual, none of which are reimbursable or paid for by the Company. Authorization Process and Exceptions: An individual requesting a Company provided mobile device must complete the designated service request form and obtain appropriate Vice President level approval. In circumstances, where standard packages do not meet the job requirements of the individual, additional features may be added to meet

those requirements with appropriate Vice President level approval. Features such as international calling and international data access plans, for example, will require appropriate Vice President level approval. Company policies strictly prohibit the attachment or connection of any Corporate Device or Personal Device to the Companys data networks without formal request, review, authorization, and approval. All requests for attachment or connection of mobile devices to Company resources must be for legitimate business reasons, approved by the appropriate Vice President level manager and be authorized and approved through the Companys mobile device request process. All users who access Company resources, with a Corporate Device or Personal Device, must comply with this policy and must agree to the Companys management of these devices. Users must also acknowledge and agree to comply with all other relevant Company policies, most specifically those addressing appropriate use and protection of Company computing systems, networks, data and information resources. Users must complete and sign the formal written Company Mobile Device Policy Acknowledgement prior to their connection to Company resources. Telecommunications Expense Management (TEM): A Telecommunications Expense Management (TEM) team will be established to manage the Companys wireless telecommunication expenses. This group will provide reporting, plan management and assessment, based on wireless agreement changes, policy compliance, and cellular usage trends, to Corporate, Group and Area management. The TEM team will receive usage information for each mobile device user and conduct periodic, independent reviews to verify that plan usage and assignment is appropriate. If usage plans require adjustment, the TEM team will contact the mobile device user and, as necessary, his or her immediate Manager. Consistent overage and feature charges may be grounds for the suspension or termination of Company provided device service. Acceptable Usage: a) Company mobile services are provided for business purposes. Except when critical for business purposes, mobile device users may not use non-plan features that incur additional charges (e.g. multimedia messages, directory assistance, navigation, etc.) b) Only the approved individual (to whom the device was issued) may use a Corporate Device; mobile device users may not loan their devices to others.

c) Whenever possible, mobile device users should avoid high cost international mobile roaming (the phone will identify when roaming and is configurable to disallow roaming) charges and international long distance charges, (anytime the user is traveling international) by utilizing lower cost public toll or calling card services. The international roaming features can be temporarily enabled for occasional planned travel. d) In general, mobile device users should utilize direct-dial numbers and not Company toll-free numbers for calling Company locations and voicemail since the Company mobile plans include long distance charges at no additional cost. e) Mobile device users must not use any mobile device that is Company managed, used for Company business, or connected to Company resources for any fraudulent or illegal activity. f) Mobile device users must comply with regulatory and Company defined use restrictions (e.g. refrain from using or texting on the device when located in designated hazard areas, when operating machinery, while driving a vehicle-unless earpiece use is specifically authorized, during air travel when device use is prohibited, etc.) Reimbursement Policy: a) For Company provided devices, all charges must be submitted via a Master Bill. Reimbursement through the expense reporting system will not be allowed. In addition, the Company will not reimburse any recurring Personal Device charges. Any exception requires appropriate Vice President level approval. b) Mobile device users will reimburse the Company for overage charges and usage charges related to features not included in standard Company plans. Should mobile device users incur such charges for business purposes, the appropriate Vice President level manager must validate and approve the said expenses for Company payment. c) Company provided devices will include travel chargers, as required. All other upgrades and nonstandard accessories are the responsibility of the mobile device userand are ineligible for reimbursement. Security Awareness: a) All mobile device users are personally responsible for maintaining protections and control over mobile devices and any Company information they may contain. Mobile device users will not intentionally neglect, misuse, or abuse their mobile device(s).

b) If a mobile device is lost or stolen, the user must report the device missing by contacting the IT Service Center/Help Desk as soon as possible, but no later than 12 hours from the time of the incident. c) Sensitive information should never be discussed or shared across cell phone services due to the cell phones transmission on public airwaves. Such information includes: confidential or proprietary Company information; personal account or PIN numbers; credit card numbers. d) All mobile devices accessing Company resources must have lock/pass code protection initiated to protect unauthorized use in the event that the device is lost or stolen. e) All mobile devices accessing Company resources must have encryption enabled to protect unauthorized disclosure in the event that the device is lost or stolen. f) Mobile device users must not jail-break, hack or in any other way obtain root access or bypass controls on their mobile devices. This compromises required security and management of the device and is a serious violation of Company policy. Termination of Mobile Services: a) The Company retains authority for the mobile service, phone number, equipment, and accessories obtained under corporate contracts. As such, mobile services can at any time be suspended or terminated by the Company. b) Upon termination of employment, the mobile device user shall render all Company mobile equipment to their immediate Manager. c) Upon termination of mobile services all mobile device users agree to make their Corporate Device(s) and/or Personal Device(s), available for review, data wiping, and return to original settings, if required. This may include erasing personal data, information, and records including files, software, music, and photos. Personal Devices will be returned to the individual owner. Corporate Devices will be retained by the Company for redeployment. d) If the Corporate Device is no longer under a service contract and the account can be cancelled without termination penalties/fees, with appropriate Manager approval, service can be terminated on the device and the device returned to the individual. If the device is under a service contract, with appropriate Manager approval, the individual may be allowed to pay any and all termination penalties/fees and the device returned to the individual. The phone number will remain a corporate number under the name of Company, however, with appropriate Vice President level approval the number maybe be transferred to a personal service plan on an individually liable account.

General: a) The Company requires the use of Company approved mobile devices, equipped with the Company specified data and network security software, configuration settings, and specific use restrictions in order to access Company resources, and to receive and/or store Company information. (Refer to the Company Approved Mobile Devices list.) Any rules or regulations regarding additional device features/functionality or carrier value-added services that are not explicitly listed should be considered prohibited. b) The Company will manage and control the configuration, security settings, device environment, and access for all mobile devices connected to Company resources. Requesting access to Company email and/or data services from a Corporate Device or Personal Device implies consent of the individual to the management of the device, including the installation of any Company controlled software necessary for device management. c) All electronic information on the Companys email system (including any documents or attachments), files systems, networks, and internet/intranet services, is considered the property of Company, and not of the individual. d) The Company has the right at all times to monitor all electronic activity and information on the Company provided systems and network, whether accessed from Corporate Device or Personal Device. e) Mobile device users must maintain and upgrade connected mobile devices and operating systems to supported versions as defined in the Company Approved Mobile Devices list in order to remain in compliance with Company supported standards. Failure to comply with these mobile device model and version standards will result in loss of mobile device privileges. f) Mobile device users must not download any unauthorized software or inappropriate files, images, or content to any mobile device that is Company managed, used for Company business, or connected to Company resources. g) This and other Company policies, will be reviewed and updated annually. Users of mobile devices must accept any changed/updated policy terms in order to retain access to Company resources. If policy changes are significant, the Company may require users to resubmit a formal written Company Mobile Device Policy Acknowledgement within 4 weeks of the policy change. Failure to accept updated policy terms may result in loss of mobile device privileges. h) Violations of this, or any other Company policy, may result in loss of mobile device privileges, suspension of access to Company resources, and/or disciplinary action up to and including

termination of employment with the Company. Approval Requirements: Approval by an appropriate Vice President level, corporate mobile device users require Department Head Vice President and field mobile device users require Area Vice President, or above is required for Company provided mobile devices. Policy Owner/Contact: The policy owner is the Vice President, Procurement & Chief Procurement Officer. Questions regarding this policy should be directed to the Policy Owner. Variance Approvals: Policy variances must be obtained from the Policy Owner. Variances must be requested using the Variance Approval Form

Attachments and Linked Pages .. . Manuals Referencing this Page . .