ISM-0249 policy ASD Information Security Manual (ISM)

Separate Classified and Personal Data on Personal Devices

Private devices must keep classified work data separate from personal data to protect sensitive info.

Preventative S TS ASD Information Security ManualGuidelines for physical security devices identity and access management user behaviour March 2026 ISM Update

record_voice_over

Plain language

This control means you need to keep work data separate from personal data on your devices. It's important because mixing the two could lead to sensitive work information being accessed by the wrong people, risking data breaches and loss of trust.

01 — Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Preventative

Classifications

S, TS

ISM last updated

Mar 2026

Control Stack last updated

24 Mar 2026

E8 maturity levels

N/A

Guideline

Guidelines for physical security

Section

Emanation security

Topic

Emanation security risk assessments

Official control statement

System owners deploying SECRET or TOP SECRET systems in mobile platforms, or as a deployable capability, contact ASD for an emanation security risk assessment.

policy ASD Information Security Manual (ISM) ISM-0249

priority_high

Why it matters

Mixing work and personal data on devices can lead to unauthorised access, data breaches, and loss of sensitive information.

settings

Operational notes

Regularly review device management policies and ensure ongoing employee awareness to maintain clear data separation on all personal devices used for work.

02 — Implement

build

Implementation tips

IT team should create separate user profiles on personal devices for work and personal use. This helps ensure that classified work data stays within the work account, reducing risk of accidental sharing with personal contacts.
Managers should educate employees on the importance of not storing work files in personal directories. Hold a short awareness session highlighting the risks and consequences of data breaches.
System administrators should configure devices to disable sharing work data via personal apps. Use device management software to prevent access to work files through unapproved applications.
HR should ensure new employees sign an agreement on the use of personal devices for work. Include clauses about data separation responsibilities and potential consequences for non-compliance.
Procurement should check that any devices used for work have updated security features. Ensure they support user profiles and can run necessary security apps to enforce data separation.

03 — Audit

fact_check

Audit / evidence tips

Askuser profile configuration records Look atif profiles clearly separate work and personal use Goodincludes profiles differentiated by use with access controls in place
Goodshows settings that restrict work data from being copied to personal apps
Askto see the employee training materials and attendance logs Look atcomprehensive sessions covering data separation Goodincludes updated materials and regular attendance from staff
Goodis all agreements duly signed and on file
Askthe list of approved personal devices used for work. Ensure each device meets the organisation’s security standards Goodis a current list with compliance checks for each device

04 — Mappings

link

Cross-framework mappings

How ISM-0249 relates to controls across ISO/IEC 27001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
handshake Supports (1) expand_less
Annex A 5.5	ISM-0249 requires system owners deploying SECRET or TOP SECRET systems on mobile platforms or as a deployable capability to contact ASD f...

These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.