A sensitive public-sector device programme should specify three things before it buys a single device: the environment the devices will work in, the controls the institution must hold over them, and the evidence each supplier must provide per device model. Otukan helps institutions and their device makers write that specification and meets it with Android-based devices hardened at firmware level. Administration, telemetry and supplier access stay under the institution’s control. Otukan backs its answers with tests on the exact models and firmware versions being procured, and with written lifecycle commitments.
Operational environment
A specification starts with the people and places the devices will serve. Otukan works through each area with the institution and records the answers in a checklist the institution owns.
Users
- Who carries the devices: office staff, inspectors, first responders, diplomats or field officers.
- Whether devices are issued one per person, shared by shift or dedicated to one task.
- Who may administer devices, and who may approve exceptions.
Networks
- Which networks devices use: the institution’s own, public mobile networks, or both.
- Whether devices must work when disconnected, and for how long.
- Which services devices reach, and which of those sit on restricted networks.
Sensitive workflows
- Which tasks handle sensitive information, such as case files, citizen data or operational plans.
- Which of those tasks need proof that the device is trustworthy before access is granted.
- What must happen to data on a device that is lost, seized or retired.
Where the programme also runs citizen-facing apps, their protection is covered on government mobile app security.
Control requirements
The specification then sets out who controls the devices once they are in service. Otukan answers the three areas that decide whether the institution stays in charge.
| Area | What the institution should require | How Otukan meets it |
|---|---|---|
| Administration | Separate roles for policy, device actions and audit; no single administrator with every power; every privileged action logged | Role design agreed with the institution, with logs held in the institution’s environment |
| Telemetry | A list of every data flow from the device and from supplier services; data held where the institution decides | Evidence and logs routed to services the institution runs or chooses, each flow documented |
| Supplier access | No standing access; sessions approved, time-limited and recorded; the institution can end any session | Support access requested and approved per session, with a record the institution keeps |
These requirements apply to the device itself as well. Otukan hardens each model’s firmware, reduces the privilege of preinstalled components and gives the institution approval over every firmware release. Data location and key custody are covered on sovereign mobile device security.
Questions to put to every supplier
- Which administrative actions can your staff perform on our devices or services, and under whose approval?
- Which data leaves our environment, to where, and why?
- Which preinstalled components on the device hold system-level privilege, and who maintains each one?
- What happens to our fleet if your support ends or our contract changes?
Otukan answers each of these in writing, per model, before contract award. Answers from different suppliers can then be compared line by line, which makes the evaluation easier to defend.
Procurement evidence
Public buyers need proof they can file and defend. Otukan supplies evidence at the level procurement teams and assessors actually test: the device model and firmware version.
Model-level validation
- Test records showing which integrity, hardening and update controls ran on each model, with dates and firmware versions.
- A data flow map for the delivered configuration, matching the telemetry requirement above.
- The administrative role design as configured, with a sample of the audit log.
Lifecycle commitments
- How long each model receives security updates, and how updates are approved before installation.
- What happens at end of support: replacement plan, data removal and device disposal.
- Which firmware images repair centres may install, and how repaired devices return to trust.
- Which builds, tools and documentation are handed over, so the institution can keep the fleet secure over its full life.
Certification requirements differ by country and programme. Otukan supplies the technical evidence the institution’s assessors request and states a certification only where it is formally held. A model-specific test plan, with baseline and protected results, is described on mobile device security evaluation. Field team devices in energy, water, transport and utilities are covered on critical infrastructure mobile device security. For the full device programme, see mobile device security.