ISM control lookup / Topic

Guidelines for enterprise mobility

51 controls · September 2026 edition

• ISM-0240 · Using paging, message services and messaging apps

  Paging, Multimedia Message Service, Short Message Service and messaging apps are not used to communicate sensitive or classified data.

• ISM-0682 · Using Bluetooth functionality

  Bluetooth functionality is not enabled on SECRET and TOP SECRET mobile devices.

• ISM-0687 · Approved mobile platforms

  Mobile devices that access SECRET or TOP SECRET systems or data use mobile platforms that have been issued an Approval for Use by ASD and are operated in accordance with the latest version of their associated Australian Communications Security Instruction.

• ISM-0694 · Privately owned mobile devices and desktop computers

  Privately owned mobile devices and desktop computers do not access SECRET and TOP SECRET systems or data.

• ISM-0701 · Mobile device emergency sanitisation processes and procedures

  Mobile device emergency sanitisation processes, and supporting mobile device emergency sanitisation procedures, are developed, implemented and maintained.

• ISM-0702 · Mobile device emergency sanitisation processes and procedures

  If a cryptographic zeroise or sanitise function is provided for cryptographic keys on a SECRET or TOP SECRET mobile device, the function is used as part of mobile device emergency sanitisation processes and procedures.

• ISM-0705 · Mobile devices and desktop computers accessing the internet

  When accessing an organisation’s network via a VPN connection, split tunnelling is disabled.

• ISM-0863 · Maintaining mobile device security

  Mobile devices prevent personnel from installing non-approved applications once provisioned.

• ISM-0864 · Maintaining mobile device security

  Mobile devices prevent personnel from disabling or modifying security functionality once provisioned.

• ISM-0866 · Using mobile devices in public spaces

  Sensitive or classified data is not viewed on mobile devices in public locations unless care is taken to reduce the chance of the screen of a mobile device being observed.

• ISM-0869 · Encrypted storage

  Mobile devices encrypt their internal storage and any removable media using ASD-approved cryptography.

• ISM-0870 · Maintaining control of mobile devices

  Mobile devices are carried or stored in a secured state when not being actively used.

• ISM-0871 · Maintaining control of mobile devices

  Mobile devices are kept under continual direct supervision when being actively used.

• ISM-0874 · Mobile devices and desktop computers accessing the internet

  Mobile devices and desktop computers access the internet via an organisation’s internet gateway rather than via a direct connection to the internet.

• ISM-1082 · Mobile device usage policy

  A mobile device usage policy is developed, implemented and maintained.

• ISM-1083 · Personnel awareness

  Personnel are advised of the sensitivity or classification permitted for voice and data communications when using mobile devices.

• ISM-1084 · Maintaining control of mobile devices

  If unable to carry or store mobile devices in a secured state, they are physically transferred in a security briefcase or an approved multi-use satchel, pouch or transit bag.

• ISM-1085 · Encrypted communications

  Mobile devices encrypt all sensitive or classified data communicated over public network infrastructure using ASD-approved cryptography.

• ISM-1088 · While travelling overseas with mobile devices

  Personnel report the potential compromise of mobile devices, removable media or credentials to their organisation as soon as possible, especially if they:

• ISM-1145 · Using mobile devices in public spaces

  Privacy filters are applied to the screens of SECRET and TOP SECRET mobile devices.

• ISM-1195 · Mobile device management policy

  Mobile Device Management solutions that have completed a Common Criteria evaluation against the Protection Profile for Mobile Device Management, version 4.0 or later, are used to enforce mobile device management policy.

• ISM-1196 · Using Bluetooth functionality

  Non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices are configured to remain undiscoverable to other Bluetooth devices except during Bluetooth pairing.

• ISM-1198 · Using Bluetooth functionality

  Bluetooth pairing for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices is performed in a manner such that connections are only made between intended Bluetooth devices.

• ISM-1199 · Using Bluetooth functionality

  Bluetooth pairings for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices are removed when there is no longer a requirement for their use.

• ISM-1200 · Using Bluetooth functionality

  Bluetooth pairing for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices is performed using Secure Connections, preferably with Numeric Comparison if supported.

• ISM-1297 · Privately owned mobile devices and desktop computers

  Legal advice is sought prior to allowing privately owned mobile devices and desktop computers to access systems or data.

• ISM-1298 · Before travelling overseas with mobile devices

  Personnel are advised of privacy and security risks when travelling overseas with mobile devices.

• ISM-1299 · Personnel awareness

  Personnel are advised to take the following precautions when using mobile devices:

• ISM-1300 · After travelling overseas with mobile devices

  Upon returning from travelling overseas with mobile devices, personnel take the following actions:

• ISM-1366 · Maintaining mobile device security

  Security updates are applied to mobile devices as soon as they become available.

• ISM-1400 · Privately owned mobile devices and desktop computers

  Personnel using privately owned mobile devices or desktop computers to access OFFICIAL: Sensitive or PROTECTED systems or data have enforced separation of classified data and personal data.

• ISM-1482 · Organisation-owned mobile devices and desktop computers

  Personnel using organisation-owned mobile devices or desktop computers to access classified systems or data have enforced separation of classified data and personal data.

• ISM-1533 · Mobile device management policy

  A mobile device management policy is developed, implemented and maintained.

• ISM-1554 · Before travelling overseas with mobile devices

  If travelling overseas with mobile devices to high or extreme risk countries, personnel are:

• ISM-1555 · Before travelling overseas with mobile devices

  Before travelling overseas with mobile devices, personnel take the following actions:

• ISM-1556 · After travelling overseas with mobile devices

  If returning from travelling overseas with mobile devices to high or extreme risk countries, personnel take the following additional actions:

• ISM-1644 · Using mobile devices in public spaces

  Sensitive or classified phone calls and conversations are not conducted in public locations unless care is taken to reduce the chance of conversations being overheard.

• ISM-1866 · Privately owned mobile devices and desktop computers

  Personnel using privately owned mobile devices or desktop computers to access OFFICIAL: Sensitive or PROTECTED systems or data are prevented from storing classified data on their privately owned mobile devices and desktop computers.

• ISM-1867 · Approved mobile platforms

  Mobile devices that access OFFICIAL: Sensitive or PROTECTED systems or data use mobile platforms that have completed a Common Criteria evaluation against the Protection Profile for Mobile Device Fundamentals, version 3.3 or later, and are operated in accordance with the latest version of their associated ASD security configuration guide.

• ISM-1868 · Encrypted storage

  SECRET and TOP SECRET mobile devices do not use removable media unless approved beforehand by ASD.

• ISM-1886 · Maintaining mobile device security

  Mobile devices are configured to operate in a supervised (or equivalent) mode.

• ISM-1887 · Maintaining mobile device security

  Mobile devices are configured with remote locate and wipe functionality.

• ISM-1888 · Maintaining mobile device security

  Mobile devices are configured with secure password-based lock screens.

• ISM-2095 · Privately owned mobile devices and desktop computers

  Personnel using privately owned mobile devices or desktop computers to access OFFICIAL: Sensitive or PROTECTED systems or data are disallowed from granting access to unapproved artificial intelligence agents.

• ISM-2096 · Maintaining mobile device security

  Mobile devices are configured to enforce separation between organisational and personal mobile applications and data.

• ISM-2097 · Maintaining mobile device security

  Mobile devices are configured with always on VPN functionality.

• ISM-2098 · Maintaining mobile device security

  Mobile devices are configured to prevent data transfers over Universal Serial Bus connections.

• ISM-2099 · Connecting mobile devices to connected vehicles

  Mobile devices are not connected to the infotainment systems of connected vehicles.

• ISM-2100 · Using mobile devices within or near connected vehicles

  Sensitive or classified data is not viewed on mobile devices within or near connected vehicles.

• ISM-2101 · Using mobile devices within or near connected vehicles

  Sensitive or classified phone calls and conversations are not conducted within or near connected vehicles.

• ISM-2108 · Encrypted communications

  Mobile applications encrypt all sensitive or classified data communicated over public network infrastructure using ASD-approved cryptography.