Merge branch 'MDM' into 'main'

`SIEM   Security Information and Event Management Systems`

`SRU    Service Requesting Users`

`PII    Personally Identifiable Information`

`CSP    Communications Service Provider`

# 4 Product context

4. ICT devices like phones, tablets, laptops and other mobile devices

5. Office equipment like printers and meeting systems

#### 4.2.2 Controller design

The product is a network controller.

1.  Establishes trust between the system and the devices.

2.  Maintain an inventory of devices that are part of the managed network.

### 4.6.x ICT Network Elements

The ICT Element management is an enterprise-focused system to control and manage the configuration of the connected enterprise application on the ICT Elements.

An ICT Element can encompass anything from routers, modems, switches up to mobile devices, tablets, smart phones, laptops, desktop PCs to servers.

The use case describes a system that provides centralized governance of the enterprise application running on the ICT Elements within the cope of an organization.

ICT device management is in general subject to enterprises or larger organization that equip their employees with the essential ICT elements they work with.

The users usually do not have full administration rights and are restricted to the application level to manage personal look and feel.

Due to the broad functionality of the ICT Elements, the controls need also to be strongly extended, compared with the IoT use case, to ensure the centralized governance by the enterprise for the related application is maintained.

That can be characterized as follows:

* Provision of preconfigured ICT elements or enterprise applications to the employees

* Centralized ICT element or enterprise application update management

* Trust establishment between the ICT elements, or the enterprise application, other communicating entities and the NMS, by the NMS

* The NMS controls and sets the ICT element and the enterprise application configuration settings to manage:

    * The connectivity of the managed ICT elements and the enterprise application among each other, like VPN configuration

    * The formation of user groups with their management in relation with dedicated access control management

* Control software installation, reporting and individual permission on the ICT element respectively enterprise application

* Backup and recovery controls for either the ICT element or the enterprise application

* ICT Element respectively enterprise application status tracking and compliance control to enterprise guidelines and safeguards

* Remote control of the ICT element or the enterprise application features if present

The employees have only those administration rights the central administration granted before and which the NMS configures accordingly to the enterprise rules.

With that the ICT elements are integral part of the business logic and enterprise processes running in the background.

Restrictions in the central governance are only present with relation to GDPR and locally applicable employee protection regulations for the enterprise owned parts.

In all known cases, for the enterprise owned parts, connectivity and its execution of centrally controlled software are subject of the central administration.

The NMS supports the central administration in their governance. In that context, the NMS can also be used to control the working times, location and connections of the employee‘s operations.

The NMS operating the configuration of the enterprise owned parts usually ensures also the enforcement of enterprise guidelines, restricts user actions, and prevents unallowed connections to protect the enterprise from data disclosure by blocking interfaces and setting restrictions for applications.

The mobile device management must not be mismatched with the management functions that are subject of the radio network management functionality that ensures connectivity and performance with the RAN.

These requirements are handled with the EN 304 642 network functions [xx].

![Multiple NMS's](./media/2026-06-22_ict_element.drawio.png)

**Figure 4.6.x-1: Multiple Network Management Systems**

ICT Elements can have four managing entities at the same time as illustrated in the figure above:

1. The ICT element enterprise application management and the ICT Element owner decide about the enterprise application installations the employee needs.

   The installation configures the ICT element when the enterprise application is launched, and that sets the user and the enterprise application rights.

   The NMS can support the installation as well as the configurations.

   The NMS controlling the enterprise application is usually able to track the ICT element when the enterprise application runs according to the enterprise rules.

   That can include also support for automated application updates.

2. For a radio-connected ICT Element, the central radio network- or telecom's administration ensures connectivity and performance of the ICT element in connection to the RAN.

   A part of the RAN settings is static and provided by the (e)SIM, another is dynamic and subject of the concrete ICT Element situation in connection to the RAN.

   The ICT Element’s operating system update is completely separated from the enterprise application and operates directly with the NMS of the operating system manufacturer.

   The enterprise application runs on a higher level.

   The radio-connected ICT Element can operate an automated update service in pull or push ways, the NMS of the operating system manufacturer can support this.

3. The similar holds for wired-connected ICT Elements but without the complexity of the RAN.

   The central telecom's administration or CSP ensures connectivity and performance of the ICT element in the wired connection.

   The ICT Element’s operating system update is completely separated from the enterprise application and operates directly with the NMS of the operating system manufacturer.

   The enterprise application runs on a higher level.

   The wired-connected ICT Element can operate an automated update service in pull or push ways, the NMS of the operating system manufacturer can support this.

4. The mobile manufacturer can update the ICT elements to upgrade, update or mitigate vulnerabilities on the ICT element excluding applications that were installed after delivery.

   This manufacturer action can take various ways or methods, also push and pull style by the mobile ICT element itself.

   Usually, updates from the ICT Element manufacturer, such as firmware, use the way via the operating system manufacturer.

   In all cases, the owner of the mobile ICT element decides.

In all cases user respectively application rights are managed and controlled, as the device management remains subject of the enterprise NMS, as the ICT elements are and remain in ownership of the enterprise.

#### 4.6.1.2 Home network deployment

![Figure 4.6.1.2-1: Home network deployment](./media/2025-08-10_homenetwork.drawio.png)

## Notes on 4.1.4 ICT device management

The chapter [4.1.4 ICT device management](#414-ict-device-management) does not have a use-case included.

ICT device management use-case highlights how there are multiple controlling entities involved in a device manamagement.

The ownership of those changes is partial and the product usability and the experience what the user ends up having, is sum of all parts.

Analogy could be made to game modding, or software plugin development.

The core is stable, but the extension crashes the system.

This document lacks a clear ownership separation and expectation setting how NMS should aknowledge the existense of other controllers.

Ownership transfer is undefined.

Stacking multiple controlling entities into a device is an operative environment design choice, but does this make the device issuing enterprise the integrator?

How much of the original manufacturer responsibility of providing updates is inherited?

How this settles in with the expected use of the product?

The following work could be a direction worth exploring:

In the greater scheme of device management, the following work could be a direction worth exploring:

* The Open Mobile Alliance (OMA) Device Management protocol [OMADM] and LightweightM2M architecture [LWM2M]

* BroadBand Forum (BBF) CPE WAN Management protocol [TR-069] developed extensive specifications to facilitate Device Management over wireless and wireline telecommunication network respectively