ASD ISM 0240 Prevent sensitive data in messaging services
What it says
Paging, Multimedia Message Service, Short Message Service and messaging apps are not used to communicate sensitive or classified data.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDo not send sensitive information using paging or messaging apps.
This control is about making sure that sensitive or classified information is not shared through messaging apps or services, like text messaging or WhatsApp. This matters because if sensitive data falls into the wrong hands, it can lead to privacy breaches, financial loss, or damage to your organisation's reputation.
Free. Save your status, tasks and notes.
Why it matters
If sensitive or classified data is sent via SMS/MMS/paging or messaging apps, it may be intercepted, causing breaches, financial loss and reputational damage.
How to implement
Office managers should identify which messaging apps are used within the organisation and ensure everyone knows not to send sensitive information via these apps.
They can do this by sending an email notice or holding a brief meeting explaining the importance of this rule.
The IT team should set up network filters to block the exchange of sensitive data through messaging apps.
This can be done by using data loss prevention tools that trigger alerts if sensitive keywords are detected in outgoing messages.
HR should update the employee handbook to include guidelines on what constitutes sensitive information and how it should be communicated.
This document should clearly state that sensitive data should not be sent via messaging services and should offer alternative methods like secure emails or business-grade collaboration tools.
Training coordinators should organise a periodic training session for employees explaining why these restrictions are important, using real-world examples of data breaches caused by mishandling sensitive information via consumer messaging apps.
Procurement staff should ensure that any new communication tools brought into the organisation meet security standards for handling sensitive data, meaning they should include features like end-to-end encryption and data leakage prevention.
Keep it running
Train staff not to send sensitive or classified data via SMS/MMS/paging or messaging apps; provide approved secure channels and regularly reinforce this rule.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The employee handbook: Request to see the sections outlining communication policies.
Look at
Specific mention of prohibited messaging methods and alternatives for handling sensitive data.
Good evidence
Is that it clearly lists messaging services not to use with reasons why.
- Check 2 of 5What an auditor asks for
Ask for
Content used in staff training sessions on secure data handling.
Look at
Information that explains the risks of using messaging apps for sensitive data.
Good evidence
Includes interactive content like quizzes or real-world examples.
- Check 3 of 5What an auditor asks for
Ask for
Them to explain how they handle sensitive information and where they would go to find the organisation's communication policy.
Good evidence
Is that they can identify correct channels and know the risks of using messaging apps.
- Check 4 of 5What an auditor asks for
Ask for
To see any recorded instances of attempted transmission of sensitive data through messaging apps.
Look at
Reports showing monitoring and alerts if such transmissions occur.
Good evidence
Has evidence that alerts are generated and reviewed.
- Check 5 of 5What an auditor asks for
Look at
Compliance with policies, like using secure systems for sensitive documents.
Good evidence
Is adherence to the policy as demonstrated through secure systems.
Mappings
Closest match in ISO/IEC 27001: A.5.10, Acceptable use policies for information and assets, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.10.
ISM-0240 requires that paging, MMS, SMS and messaging apps are not used to communicate sensitive or classified data. Annex A 5.10 requires the organisation to define and implement acceptable use rules and handling procedures for information and associated assets, which is the governance mechanism that would include banning sensitive data use in consumer messaging services. ISM-0240 is a specific, channel-focused prohibition, while Annex A 5.10 is broader policy coverage across many asset and information usage scenarios.
This control partially meets A.5.14.
Annex A 5.14 requires organisations to establish rules and procedures that control how information is transferred, including selecting appropriate transfer channels. ISM-0240 supports this by prohibiting use of SMS/MMS/paging and messaging apps for communicating sensitive or classified data, effectively defining an information transfer rule for certain channels. ISM-0240 is limited to specific messaging services and sensitive/classified data, while Annex A 5.14 applies across all information types and transfer facilities.
This control partially meets A.8.12.
Annex A 8.12 requires organisations to apply data leakage prevention measures wherever sensitive information is processed, stored, or transmitted. ISM-0240 directly relates by prohibiting the use of SMS/MMS/paging and messaging apps for communicating sensitive or classified data, reducing a common exfiltration channel. ISM-0240 is a channel-specific restriction, whereas Annex A 8.12 is broader and expects DLP across many channels and technologies.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.