Bluetooth Baseline Requirements Policy
Bluetooth Baseline Requirements Policy
Section titled “Bluetooth Baseline Requirements Policy”Authorized By: Chief Information Security Officer (CISO)
Purpose/Overview
Section titled “Purpose/Overview”Bluetooth connectivity, if misconfigured, can expose Safire to data interception, spoofing, and device compromise. This policy establishes minimum security requirements for Bluetooth-enabled devices connecting to Safire networks, company-owned devices, or handling Safire information, to protect Personally Identifiable Information (PII) and confidential company data.
This policy applies to any Bluetooth-enabled device that connects to Safire’s network, any company-owned device, or any device that stores, processes, or transmits Safire information. It applies to employees, contractors, third parties, and service providers.
Policy
Section titled “Policy”Bluetooth Versions and Protocols
Section titled “Bluetooth Versions and Protocols”- Legacy Minimum Standard: No Bluetooth device shall be deployed on company equipment unless it meets at least Bluetooth v2.1 + EDR specifications (supporting Secure Simple Pairing) without a prior, documented exception approved by the Approval Authority.
- Preferred Baseline: Devices should utilize Bluetooth v4.2 or later with LE Secure Connections enabled.
- Legacy Restrictions: Legacy pairing methods (PIN code only mode / Legacy Pairing) must be disabled whenever the device hardware supports Secure Simple Pairing (SSP).
Pins and Pairing
Section titled “Pins and Pairing”- Environment: Users must ensure they are not in a public area where PIN entry can be visually compromised (shoulder surfing) when pairing devices.
- Unsolicited Pairing Requests: If a Bluetooth-enabled device prompts for a PIN or pairing confirmation after the initial setup has been completed, the user must refuse the pairing request and report it to the IT Department immediately.
Device Security Settings
Section titled “Device Security Settings”- Encryption: All Bluetooth devices shall employ security modes that encrypt traffic in both directions between the Bluetooth device and its paired equipment.
- PIN Strength: When legacy pairing is unavoidable, use a minimum PIN length of 8 characters. Default PINs (e.g., “0000” or “1234”) must be changed immediately.
- Discoverability: Switch the Bluetooth device to use the Hidden (Non-discoverable) mode by default.
- Activation: Only activate Bluetooth when it is needed.
- Firmware: Ensure device firmware is up-to-date.
Data Protection (CUI and PII)
Section titled “Data Protection (CUI and PII)”- Prohibition on CUI Transmission: Controlled Unclassified Information (CUI) and Highly Sensitive PII must NOT be transmitted over Bluetooth connections unless the data is
independently encrypted using a FIPS-validated application (e.g., a VPN or encrypted file container) prior to transmission. Native Bluetooth encryption alone is insufficient for CUI.
- Live Voice/Audio: Sensitive company discussions should not be held over Bluetooth headsets in public areas due to the risk of signal interception and eavesdropping.
Security Audits
Section titled “Security Audits”The CISO, IT, or Compliance teams ( in coordination with the Head of People) reserve the right to perform random audits and wireless scans to ensure compliance with this policy.
- Scanning may include identifying discoverable devices and verifying encryption standards.
- In the process of performing such audits, personnel shall not intentionally eavesdrop on live voice conversations.
Unauthorized Use
Section titled “Unauthorized Use”The following is a list of unauthorized uses of company-owned Bluetooth devices:
- Eavesdropping, device ID spoofing, Denial of Service (DoS) attacks, or any form of attacking other Bluetooth-enabled devices.
- Using company-owned Bluetooth equipment on non-company-owned Bluetooth-enabled devices (e.g., pairing a company laptop to a personal unsecured speaker).
- Unauthorized modification of Bluetooth devices for any purpose.
User Responsibilities
Section titled “User Responsibilities”It is the Bluetooth user’s responsibility to comply with this policy.
- Radio Management: Bluetooth radios on host devices (laptops, smartphones) should be disabled when not required for business operations.
- Lost Devices: Bluetooth users are required to report any misuse, loss, or theft of Bluetooth devices immediately to the IT Department.
- Connection Integrity: Users must verify that they are connecting to the intended device and not a spoofed device with a similar name.
Compliance
Section titled “Compliance”Compliance Measurement
Section titled “Compliance Measurement”The policy owner will verify compliance through methods such as business tool reports, wireless scanning, and internal audits. Oversight is provided by CISO, IT, and Compliance functions. The CISO has the authority to temporarily restrict access to systems or data for any entity found to be non-compliant with this policy, pending final disposition by the CEO.
Exceptions
Section titled “Exceptions”Any exceptions (including the use of legacy Bluetooth v2.1 devices) must be approved by the Policy Owner in advance.
Non-Compliance
Section titled “Non-Compliance”An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.
Related Standards, Policies, Plans, and Procedures
Section titled “Related Standards, Policies, Plans, and Procedures”None .
Referenced Terms
- CUI
- Information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies.
Revision History
- 2026-08-20 — Darren Rush
- Merge pull request #2 from safire-dev/dev (
16cb681)