Vetting mobile apps with NIST
NIST SP 800-163 Rev. 1 helps public and private organisations decide whether a mobile app is suitable for a specific use. MobSTR supplies evidence for that review. Your organisation owns the decision.
Set requirements
Identify the app’s purpose, data and acceptable permissions. The organisation sets the policy and names the person who can accept exceptions.
Receive the app
Start with a store listing or an Android package. Record the requested use and verify that the reviewed version matches the planned deployment.
Test and assess
Inspect the permissions, components and security findings. The analyst can request runtime or manual testing when a finding needs more evidence.
Decide and record
The analyst recommends an outcome. The authorising official weighs the intended use and outstanding risk. Record the decision and any mitigations.
Share the result
Give the requester the authorised outcome and supporting assessment. The mobility team implements the decision through its own deployment controls.
Review changes
A new store release triggers a MobSTR rescan. Review changed findings against the original decision and assign responsibility for any follow-up.
What an approval looks like
A team requests a receipt-scanning app. Camera access fits the task, but the analyst also finds a request for contacts. The approver records the app version, asks the supplier to explain the permission and defers rollout until the team has enough evidence.