Travel Security Policy Template: Devices, Data and Border Searches on Business Trips

Business travel takes your people, laptops, phones and credentials out of the controlled environment and into airports, hotels and border checkpoints where devices can be lost, stolen, inspected or tampered with. This template gives you numbered policy statements for travel risk tiers, loaner and clean devices, border inspections, networks, physical custody, incident reporting and post-travel checks. It builds on NIST SP 800-53 Rev. 5 control CM-2(7), Configure Systems and Components for High-risk Areas, which describes issuing specially configured laptops for travel to locations of concern and examining or reimaging them on return, and it maps each section to ISO/IEC 27001:2022, NIST CSF 2.0 and NIST SP 800-53. It is for security, IT and travel or HR leaders who need a policy they can adopt as written. For practical advice to individual travellers, read the Travel Cybersecurity Guide; this page is the policy document.

How to use this template

• Replace text in square brackets, such as [Organisation], [Security team] and [5 working days], with your own roles and values. Bracketed values are illustrative, not legal requirements.
• "Must" is mandatory; "should" is recommended practice where a documented deviation is acceptable.
• Decide your destination tiers first (table below), because device, network and reporting rules scale with the tier.
• Have legal counsel review section 4.5 on border inspections for the countries your staff visit most. Border powers differ by country and change; this template does not tell anyone to refuse a lawful request.
• Keep step-by-step device preparation in a supporting IT procedure so the policy stays short and stable.

Destination tiers

Base the tier on a list maintained by [Security team], informed by government travel advice such as the UK FCDO foreign travel advice, which covers safety and security, entry requirements and legal differences for each country, and your own threat intelligence.

1. Purpose

This policy protects [Organisation]'s people, information and systems when staff travel for business, by setting minimum requirements for devices, data, networks and incident reporting before, during and after travel.

2. Scope

This policy applies to all employees, contractors and board members of [Organisation] who travel outside their normal place of work, domestically or internationally, with [Organisation] information or devices, or with personal devices that access [Organisation] systems. It covers laptops, phones, tablets, removable media, hardware security keys and paper records.

3. Roles and responsibilities

• [CISO]: owns this policy, approves High-tier travel and exceptions.
• [Security team]: maintains the destination tier list, briefs travellers, receives incident reports and runs post-travel checks.
• [IT service desk]: issues and reimages loaner devices, enforces device configuration and handles lost device actions.
• [Travel and HR]: notifies [Security team] of bookings to Elevated or High destinations and keeps traveller contact details.
• Line managers: approve travel and confirm the traveller needs the data and access they plan to carry.
• Travellers: follow this policy, keep devices in their custody and report incidents promptly.

4. Policy statements

4.1 Planning and approval

1. Travel to Elevated or High destinations must be notified to [Security team] at least [10 working days] before departure, or as soon as booked if later.
2. Travellers to Elevated and High destinations must complete the [Organisation] travel security briefing before departure.
3. Line managers must confirm which systems and data the traveller needs; access not needed for the trip should be suspended for its duration where practical.
4. Travellers must not take [Restricted] information to High destinations unless approved in writing by [CISO].

4.2 Devices

1. Only [Organisation]-managed devices may be used to access [Organisation] systems while travelling to Elevated or High destinations; personal devices must not be used for work there.
2. All devices taken must have full-disk encryption enabled, a screen lock of no more than [5 minutes], current security updates, and remote locate and wipe enabled.
3. For High destinations, travellers must use a loaner laptop and phone issued by [IT service desk], configured with a minimal set of applications and no locally stored data beyond what the trip requires, and must leave their usual devices at home or in the office.
4. Devices should hold only the data needed for the trip; working files should be accessed through approved cloud services rather than stored locally.
5. Travellers at elevated personal risk, such as executives or staff in sensitive roles, should enable platform hardening modes where approved by [Security team], for example Apple Lockdown Mode on iPhone, iPad and Mac. See the Apple Lockdown Mode Guide.
6. Removable media must be encrypted and must not be accepted from, or connected to, unknown parties or public charging points.

4.3 Accounts and credentials

1. All accounts used while travelling must use multi-factor authentication; phishing-resistant methods such as security keys or passkeys should be used for privileged and executive accounts.
2. Security keys must be carried separately from the device they protect.
3. Privileged and administrative access must not be used from Elevated or High destinations unless approved by [CISO] for a specific task; privileged sessions should be routed through [Organisation]'s privileged access solution.
4. Passwords must not be written down with the device or stored outside the approved password manager.
5. Travellers returning from High destinations must change the passwords of accounts used during the trip, and [Security team] must review recent sign-in activity for those accounts.

4.4 Networks and communications

1. Devices must connect to [Organisation] services through the always-on VPN or approved zero trust access client whenever they use a network not owned by [Organisation].
2. Travellers should prefer a [Organisation]-issued mobile hotspot or mobile data over hotel and public Wi-Fi.
3. Automatic joining of open Wi-Fi networks must be disabled; networks joined during travel should be removed afterwards.
4. Bluetooth and file sharing should be switched off when not in use, and unsolicited pairing requests rejected.
5. Sensitive conversations should not take place on public networks or in public spaces; travellers should use approved end-to-end encrypted messaging and calling applications.

4.5 Border and customs inspections

1. Travellers must comply with lawful requests from border, customs and police officers. Border authorities in several countries have powers to question travellers and examine devices; for example, the Canada Border Services Agency states that travellers are obliged to provide their password when asked and that failure to grant access may result in detention of the device, and Schedule 7 to the UK Terrorism Act 2000 places a duty on people examined at ports to give information requested and makes wilful failure to comply an offence.
2. Travellers should minimise what can be inspected by carrying loaner or minimal-data devices as required by section 4.2, and should power down devices before crossing a border.
3. Travellers must not attempt to destroy, hide or wipe a device in the presence of officers.
4. Where a device is taken out of the traveller's sight, examined, copied or retained, or a password is provided to an officer, the traveller must report this to [Security team] as soon as it is safe to do so. The device must be treated as compromised under section 4.8.
5. Travellers carrying legally privileged, regulated or export-controlled information must take advice from [Legal] before travel.

4.6 Physical custody

1. Devices and paper records must remain in the traveller's personal custody or a locked, controlled location; devices must not be checked in as hold luggage.
2. Hotel room safes should not be relied on for High-tier devices; travellers should keep these devices with them.
3. Devices must be locked whenever unattended, even briefly.
4. Travellers should use a privacy screen when working in public places and be alert to attempts to elicit information through conversation.

4.7 Incident reporting

1. Travellers must report to [Security team] via [24/7 contact] within [1 hour] of becoming aware of: a lost or stolen device; a device out of their sight in suspicious circumstances; a border examination or copying of a device; suspected phishing, account compromise or unexpected MFA prompts; or an approach seeking information.
2. [IT service desk] must be able to lock and wipe managed devices and revoke their sessions and certificates on report.
3. Reporting a mistake or loss will not in itself lead to disciplinary action; failing to report may.

4.8 Return from travel

1. Loaner devices must be returned to [IT service desk] within [2 working days] of return and wiped and reimaged before reissue.
2. Devices returning from High destinations, and any device reported under 4.5.4 or 4.7.1, must be examined for signs of physical tampering and must be wiped and reimaged, or retired, before being reconnected to [Organisation] networks.
3. Credentials and sessions used during High-tier travel must be reset in line with 4.3.5.

5. Exceptions

Exceptions must be requested in writing, approved by [CISO], time-limited to the trip and recorded in the exceptions register with the compensating controls agreed.

6. Compliance and monitoring

[Security team] will monitor compliance through travel booking notifications, briefing completion records, loaner device issue and return logs, device management compliance reports and incident records. Breaches of this policy may lead to disciplinary action in line with [Organisation]'s disciplinary procedure.

7. Review and approval

This policy is reviewed at least [annually] and after any significant travel-related incident or change in the destination tier list. Owner: [CISO]. Approved by: [Approving body]. Version: [1.0]. Effective date: [date].

Implementation guidance

Rolling out the policy

1. Build the tier list: start with a short list of High destinations and the roles that always count as High (executives, privileged administrators), then expand.
2. Connect to bookings: configure your travel booking tool or agency to notify [Security team] automatically for Elevated and High destinations. Without this, the policy depends on memory.
3. Build a loaner pool: prepare a small set of laptops and phones with a minimal build, enrolled in device management, with a documented reimage procedure. NIST SP 800-53 CM-2(7) describes exactly this pattern.
4. Pilot: run the process with one team that travels often for a quarter, measure friction and fix the procedure before rolling out.
5. Brief and remind: send travellers a one-page summary with the 24/7 reporting contact when a High or Elevated booking is detected.

Decisions for small and large organisations

Measuring the policy

• Notification rate: share of Elevated and High trips notified to [Security team] before departure.
• Loaner use: share of High trips that used a loaner device.
• Time to report: median time from a lost device or border examination to the report.
• Reimage compliance: share of returning High-tier devices reimaged before reconnection.

Common failure patterns

• Policy without booking integration: nobody knows who is travelling where, so the tier rules never trigger.
• Loaners with synced data: the loaner signs in to the same cloud profile and pulls down years of email and files, defeating the purpose.
• Silence after an inspection: travellers do not report a device examination because they fear blame, and the device goes straight back on the network.
• Executives exempt: the people most likely to be targeted are allowed to travel with their everyday devices.
• Telling staff to refuse officers: instructions that put travellers in legal jeopardy; the policy should reduce what is on the device instead.

Framework mapping

Standards and references

• NIST: SP 800-53 Rev. 5, Security and Privacy Controls (CM-2(7), AC-19)
• NIST: Cybersecurity Framework 2.0
• UK legislation: Terrorism Act 2000, Schedule 7
• Canada Border Services Agency: Examination of digital devices at the border
• UK FCDO: Foreign travel advice
• NSA: Securing Wireless Devices in Public Settings
• NCSC: Device security guidance

Related NHI Mgmt Group resources: Travel Cybersecurity Guide · Public Wi-Fi Safety Guide · Apple Lockdown Mode Guide · Phishing-Resistant MFA Guide. This template summarises border inspection powers as published by the cited authorities and is not legal advice.