Why a policy is not a plan
Most departments have a device policy. It was written by the information technology office, it is several pages long, and it concerns the institution's network. It says nothing about the playbook application a position coach installed on his personal tablet, the group message that still includes a coordinator who left two seasons ago, or the cloud account that has been quietly copying every photograph of the whiteboard to a telephone the program does not own.
A plan is shorter than a policy and it is written for the people who carry the devices. It fits on one page. Each staff member completes it in the room, signs it, and keeps it. The director of operations keeps the copies. That is the whole administrative apparatus.
The seven rules
These are the items on the checklist we issue in the tradecraft session. None of them costs money. All of them can be done on the device in the time it takes to read this article.
- The lock screen hides message previews. A telephone face up on a table in the hotel bar shows the first line of every message to anyone standing nearby. Turn previews off. This is the single most common finding in the assessment and the cheapest to fix.
- A six-digit or longer passcode, biometrics on, auto-lock under one minute. Four digits are guessed in an afternoon by someone who has watched you type them once. Face or fingerprint is faster than a passcode anyway, so the longer passcode costs nothing in practice.
- The cloud backup is reviewed. Photographs of the whiteboard, screenshots of the plan and recordings of the install meeting go wherever the device's photographs go. On most telephones that is a personal cloud account whose password was set in college. Either the plan does not get photographed, or the account is one the program controls.
- Group messages are reviewed and former staff are removed. Do this today and again at every staff change. Turn disappearing messages on for any thread where the plan is discussed. The conversation does not need to exist in January.
- Remote wipe is enabled and has been tested once. Every modern device can be erased from a browser. Almost no one has ever done it, which is why the first attempt is made at eleven at night in a hotel in another time zone by someone who has forgotten the account password. Test it on an old device in the office.
- In a hotel, hotspot or password network only. The open network in the lobby is run by whoever set it up, which is sometimes the hotel. A telephone's hotspot is slower and it is yours.
- The name of the person to call if the device is lost is written on a card in the wallet. Not stored in the telephone, which is the thing that is missing.
What travels and what stays home
Before every road trip the question is asked once, out loud, by the director of operations: what is on the devices that are coming, and does it need to be. The full-season install does not need to travel to a conference game. The recruiting board does not need to be on a graduate assistant's tablet in a bowl hotel. A plan that lives on fewer devices is a plan that is lost less often.
The same question applies to paper. The printed itinerary with room numbers, the rooming list, the depth chart on the clipboard: each of them is a document that can be read upside down by the person at the next table. Print fewer. Collect them on the bus.
The scenario to rehearse
In the assessment we walk the staff through one scenario in detail: a coach's telephone, with the plan on it, is missing on a road trip. It is a Friday night. Who receives the call? Does that person know how to trigger the wipe? Do they have the account credentials? Who decides whether the plan is compromised and what changes for tomorrow? Who tells the head coach, and when?
In most buildings the honest answers are: no one in particular, no, no, no one has thought about it, and in the morning. Rehearsing the scenario once, around a table, for twenty minutes, produces a page of answers. That page is the incident-response section of the device plan.
The first hour after a device goes missing
- Retrace for ten minutes, no longer. Most devices are in the other jacket.
- Call the person on the card. That person starts a clock and a note.
- Locate, then lock, then wipe. Locate first, because a device at the stadium is a different problem from a device in a stranger's car. Lock it with a message and a contact number. If it is not recovered within the hour, wipe it.
- Change the passwords for the playbook application, the film system and the email account, from a different device.
- Decide what was on it and whether anything changes for the next game. Usually the honest answer is that the device was locked and nothing changes. Write that down too.
- Tell the head coach what was lost, what was done, and what the exposure is. Before kickoff, not after.
Who owns the plan
The director of football operations. Not information technology, who own the network and will be glad to help, and not the head coach, who has other work. The plan is reviewed at the start of camp and before the postseason, and every new staff member completes the checklist in their first week. In the principal's experience a staff that has done this once keeps doing it, because the rules are the kind that make sense the moment they are stated.