@@ -799,6 +799,54 @@ Beyond collecting data from connected devices and preparing data metrics, the NM
1. Establishes trust between the system and the devices.
2. Maintain an inventory of devices that are part of the managed network.
### 4.6.x Device tracking and compliance control
The ICT device management belongs also to the ecosystem management and appears as a specialization of the IoT use-case, where the IoT elements are just replaced with ICT components.
And, that can include also mobile device management. In contrast to the IoT devices, the ICT components usually have a much broader functional scope and are not limited with respect to their connectivity, purpose and functionality.
For that reason, although appearing similar as the IoT use case, the controls of the connected ICT elements are strongly extended to ensure the centralized governance.
It can be characterized as follows:
* Delivery of preconfigured ICT elements to the users
* Software delivery to the ICT elements and its update management
* Trust establishment between communicating entities and the NMS
* The NMS controls and sets the ICT element configuration settings to manage:
* The connectivity of the managed ICT elements among each other
* From user group management with dedicated access control management
* ICT element VPN and remote connectivity
* Control software installation, reporting and individual ICT element permissions
* Backup and recovery controls
* Device status tracking and compliance control to enterprise guidelines and safeguards
* Remote control of device application features if present
ICT device management is in general subject to enterprises or larger organization that equip their employees with the essential ICT elements they work with.
That includes mobile devices, notebooks but also enterprise specific other devices and related software to all of that.
Other than it might be in the IoT use case, the ICT elements remain in the ownership and governance of the issuing enterprise.
The users do not have full administration rights and are usually restricted to the application level to manage personal look and feel.
In other words, the employees have only those administration rights the central administration granted before and which the NMS configures accordingly to the enterprise rules.
With that the ICT elements are integral part of the business logic and enterprise processes running in the background.
Restrictions in the central governance are only present with relation to GDPR and locally applicable employee protection regulations.
In all known cases, the ICT element functionality, connectivity and its execution of centrally controlled software are subject of the central administration.
The NMS supports the central administration in their governance.
In that context, the NMS can also be used to control the working times, location and connections of the employees operate.
The NMS operating the configuration of the managed ICT elements, usually ensures also the enforcement of enterprise guidelines, restricts user actions, and prevents unallowed connections to protect the enterprise from data disclosure by blocking interfaces and setting restrictions for applications.
The mobile device management must not be mismatched with the management functions that are subject of the radio network management functionality that ensures connectivity and performance with the RAN.
These requirements are handled with the EN 304 642 network functions [xx].
Mobile ICT elements that use a public radio network can have three managing entities at the same time:
1. the mobile manufacturer can update the ICT elements to upgrade, update or mitigate vulnerabilities on the ICT element excluding applications that were installed after delivery.
This manufacturer action can take various ways or methods, also push and pull style by the mobile ICT element itself.
In all cases, the owner of the mobile ICT element decides.
2. the central radio network- or telecom's administration ensures connectivity and performance of the ICT element in connection to the RAN.
A part of the RAN settings is static and provided by the (e)SIM, another is dynamic and subject of the concrete ICT element situation in connection to the RAN.
3. the ICT element management of the issuing enterprise, the ICT element owner, installs the applications the employee needs, pre-configures the mobile ICT element, the user and the application rights. The NMS or a dedicated other system can support this.
The ICT element owner’s NMS is usually able to track the mobile ICT elements according to the enterprise rules.
In all cases user respectively application rights are managed and controlled, as the device management remains subject of the enterprise NMS, as the ICT elements are and remain in ownership of the enterprise.
#### 4.6.1.2 Home network deployment
