ยท NIST 800-171
Mobile Device Management for CUI: iOS, Android, and the BYOD Question
Mobile endpoints enter the CUI boundary as soon as users access or store CUI on them, so you need clear scope, NIST SP 800-171 controls applied to iOS and Android, and enforceable MDM or MAM policies before you allow mobile access.