Payroll - Procedure 23830

Procedure 23830: Mobile Communication Device

Contacts and revision dates:

Table of Contents

1. Allowance Calculation
2. Allowance Procedures
3. Mobile Communication Device Best Practices
   1. General Security
   2. Transmission Security
   3. Application and Data Security

Allowance Calculation

Under the principle that the university should provide employees with the tools necessary to perform their jobs, the university has two options for the provisioning of mobile communication devices and service plans. The purpose of this document is to provide guidance and procedures for the effective implementation of the Allowance Payment Option, Option #2 in Policy 3960. This option should be selected only when mutually agreed upon between the department head and the employee. Option #2 is not intended to be used to inappropriately burden the employee or as a means of cost reduction for the department. Employees who have been issued a university- provided device and service plan and wish to change to Option #2 and receive a reimbursement allowance must gain approval from their Department Head. Departments must remember to notify Network Infrastructure & Services (NI&S) and cancel the existing university plan to terminate the associated charges. Option #2 is limited to salaried employees.

The department head will determine the appropriate allowance plan. The Mobile Communication Device (MCD) allowance request cannot exceed the employee’s monthly cost for the service on the device used for university business. There are 3 plans available. Plan 1 includes a basic phone with talk/ text and limited data. Plan 2 is a basic phone with talk/ text and unlimited data. Plan 3 includes a smartphone with talk/ text and unlimited data, higher storage capacity, and high speeds connections with hot spot capabilities. The employee may select a provider as desired as long as the services meet the business requirements of the department.

The service device amount reflects 1/24 of the total costs of a device which is the current industry standard for amortizing the cost of this technology in consumer plans. Please note, the amounts in the table below are the monthly disbursement amount (effective 2/1/22) and not per paycheck.  

Allowance Procedures

• To qualify for an allowance, the employee must meet one of the eligibility requirements outlined in section 2.1 of the university’s mobile communication device policy. After the department head determines the employee meets at least one of the eligibility requirements and the allowance option is mutually agreed upon, the employee is responsible for obtaining a mobile communication device and monthly service plan that meets or exceeds the level of service required to fulfill job responsibilities. Note: federal grants and/or sponsored projects do not permit paying allowances for a Mobile Communication Device (MCD) due to the inability to assign costs with accuracy and efficiency (OMB Circular A-21 Section D.1).
• Allowances apply only to employee-owned MCDs and must be less than the employee’s monthly cost to maintain the device. An allowance will be paid to the employee each pay period through university Payroll as a non-taxable reimbursement for the business use of a personal device and monthly service plan. The reimbursement for the business use of a personal device has been designated by the Internal Revenue Service (IRS) as non-taxable if the required documentation and substantiation of business need is met as discussed in the policy and below.
• Departments may provide a university-provided cellular phone or Mobile Communication Device Allowance (MCDA), in addition to a remote work location allowance (RWLA), when the employee meets one or more of the eligibility criteria defined in Policy No. 3960 Mobile Communication Devices. Departments must consider the nature of the employee’s work responsibilities and ensure that university paid costs are justified when authorizing a United Communications Softphone, university-provided mobile communication device, university-provided broadband data card, or MCDA in conjunction with a RWLA. 
• Employees who have been issued a university-provided device and service plan and wish to convert to a reimbursement allowance must gain approval from their Department Head. Departments must remember to notify NI&S and cancel the existing university plan to terminate the associated charges. Note: before allowing an employee to terminate an existing university plan, department heads should consider the cost of device(s) paid for by the department.
• Initial approval (when started) and annual recertification of the business need for the allowance is required and must be documented by December 24 each year using the Mobile Communications Device Request Form. Without annual recertification, the allowance will automatically terminate on December 24 of each year. Employees and Departments are encouraged to begin the recertification process in November or early December. The allowance will become effective on the most reasonable processing date after the form is received. No retroactive payments will be permitted to employees.
• To obtain an initial allowance or to recertify to maintain an existing allowance.
  • Employees must complete the MCD Request Form, attach a current monthly billing statement from the service provider, sign the form, and obtain the department head’s signature. The monthly billing statement must be current (within the last month or two) and the monthly cost of the employee-owned device must be documented. The MCD allowance request cannot exceed the employee’s monthly cost for the service on the device used for university business.
  • Departments need to complete a P3A form for new allowances and submit it to Human Resources. All MCD Request Forms should be maintained in the department files.
  • An annual P3A is not needed for employees who are eligible to continue the mobile allowance. Annually, the Payroll area of the Controller’s Office will distribute confirmations to Senior Management areas attaching a listing of employees with mobile allowances. The department will review the listing for accuracy and make any needed adjustments. Once complete, the department must sign and return the annual recertification MDA letter sent by Payroll. Individuals with split funding will appear on the confirmation with the majority of the charge.
    • By signing the annual certification, the department is verifying the listing is correct and they have obtained the Mobile Communication Device Request form from each employee along with receiving documentation of the employee’s current monthly billing statement from their service provider. 
  • The allowance will be reflected on the existing Banner employee job record using a mobile allowance, MA suffix. MA job records have an annual rate (equal to the monthly allowance multiplied by 12). Departments can process a PAF in Banner to manage funding for the MCD allowance (which can be different than funding on the regular position). If the payment is issued and the funding for the allowance needs to be changed retroactively, this can be accomplished using the Labor Redistribution process.
  •  Employees will see an earn code with a description of MCA on the pay stub. If an employee changes jobs or their job is terminated the allowance will automatically terminate.
  • The university will not purchase, repair, or replace the mobile communication device and/or accessories for employees receiving an allowance.
  • Employees electing to change from a university provided device to the allowance option should be aware that NI&S may be able to port a business phone number to a personal device and plan with the carrier of the employee’s choice. NI&S does offer a Unified Communications Mobility package as well. Additional information is available here.  These features include:
    • Extend Call - while on an active call on your desk phone, Extend Call allows you to move that call to your cell phone and seamlessly continue your conversation as though you were still on the university telephone network.
    • Mobility (also called EC500) - The Mobility feature is an expanded version of Extend Call. With Mobility activated on your desk phone, all incoming calls will ring to both your desk phone and your cell phone. Either device can answer the call and appear as your Virginia Tech extension to the outside caller.
    • Voice Mail Text Notification- Receive a text message on your cell phone when you receive a voice mail at your university extension.
  • Employees are responsible for the protection and retention of university data stored on the device. The portion of data related to business use may be subject to the Freedom of Information Act (FOIA) and/or other appropriate legal requests and the device must be available upon request for such information. Note: Personal information stored on the device, while not typically part of a FOIA request, may be examined by Virginia Tech Information Technology and/or other university personnel during the normal course of compliance with such requests.
  • Transmission of Personally Identifiable Information from mobile devices must be encrypted based on The Standard for High Risk Digital Data Protection.
  • Employees receiving an allowance must notify their respective dean, director or department head when mobile communication services are altered or terminated. The allowance amount must always be less than the employee’s monthly cost to maintain the device.
  • Most Android and Apple iOS phones provide a way for users to limit or restrict the use of cellular data. Refer to your phone manual for specific instructions. Additionally, the FCC has actively engaged the major cellular service providers to develop an agreement for proactively alerting consumers when they approach usage thresholds that may result in overage charges on their account. Additional information regarding the FCC’s involvement in this area can be found here.
  • Employees who are eligible to receive a MCD or an allowance and who frequently travel internationally are advised to obtain a university-provided device and service plan. Under option #1, NI&S is available to advise employees regarding international travel. Employees who have chosen option #2 and infrequently travel internationally are advised to contact their service plan provider for guidance prior to traveling outside the U.S. Reimbursement for additional charges for international travel is available through the normal travel reimbursement processes with proper supporting documentation, such as a receipt or monthly phone bill with the additional charges displayed.

Mobile Communication Device (MCD) Best Practices

The purpose of these best practice guidelines is to make university employees aware of the potential information security vulnerabilities associated with the utilization of an MCD. All employees who utilize a mobile communication device to conduct university business are advised to read and apply the below security procedures.

General Security

• Keep mobile devices with you at all times or store them in a secured location when not in use. Do not leave your mobile devices unattended in public locations (e.g. airport lounges, meeting rooms, restaurants, etc.).
• Mobile devices should be password protected and auto lockout should be enabled. The password should block all access to the device until a valid password in enabled. The password used should be as strong a password as your device will support.
• Enable a “remote swipe” feature if available. This also includes features that delete data stored on the mobile device if a password is incorrectly entered a certain number of specified tries.
• Do not circumvent security features or otherwise “jailbreak” your mobile device.
• Standard security protocols should be followed. This includes ensuring your device has current anti-virus software and all operating system and application updates and patches. Firewalls should be enabled if possible.
• Wipe or securely delete data from your mobile device before you dispose of it.
• Wipe or securely delete university data from your mobile device when terminating employment with the university.

Transmission Security

• Transmission of Personally Identifiable Information from mobile devices must be encrypted based on The Standard for High Risk Digital Data Protection.
• Wireless access, such as Bluetooth, WiFi, etc., to the mobile device should be disabled when not in use to prevent unauthorized wireless access to the device.
  • In general, keep your wireless connection on hidden mode unless you specifically need to be visible to others.
• If available, wireless access should be configured to query the user for confirmation before connecting to wireless networks.
  • For example, when Bluetooth is on, select the “check with me before connecting” option to prevent automatic connections with other devices.
• Be careful when using unsecured networks and always use the VT-Wireless or eduroam network to connect while on campus or Virginia Tech’s VPN when available remotely.
  • VPN service allows you to access Blacksburg campus university services as though you were on the Virginia Tech network, even though you may be miles or continents away. Limiting service to university network addresses restricts the scope of exposure. For those university services that restrict access to campus network addresses, the remote access - VPN service is a way of selectively re-opening services only to known members of the university community. The remote access - VPN service only encrypts the information between the VPN client and the Virginia Tech VPN gateway. It does not provide end-to-end encryption.
  • The service supports smart phones running the Android and Apple iOS mobile operating systems. Additional information can be found here.

Application and Data Security

• Do not install software from unknown sources as they may include software harmful to your device. Research any software you intend to install to make sure that it is legitimate.
• When installing software, review the application permissions. Modern applications may share more information about you than you are comfortable with, including allowing for real time tracking of your location.
• Be careful when storing business and personal data on your mobile device. If the device is lost or stolen, then the data is also at risk. Lost, stolen, or misplaced mobile devices should be immediately reported to the Virginia Tech Police. If your mobile device contained university data, also inform your department about a lost, stolen, or misplaced device. The department head or designee should consider contacting the IT Security Office for further guidance.

This is a controlled document when viewed online. Printed copies are considered uncontrolled and may not reflect the most current version.