What does ASD ISM 0682 require?

policyASD Information Security Manual (ISM)

ASD ISM 0682Disable Bluetooth on SECRET/TS Mobile Devices

Official control statement

Bluetooth functionality is not enabled on SECRET and TOP SECRET mobile devices.

policyASD Information Security Manual (ISM)ISM-0682

Quoted as published. Everything else on this page is written by Control Stack.

In plain English

Bluetooth must be turned off on mobile devices with SECRET or TOP SECRET information to prevent data leaks.

S TSASD Information Security ManualGuidelines for enterprise mobility

Control Stack classificationPreventative Mobile devices Wireless networks

record_voice_over

What this means in practice

This control means that Bluetooth, a way for devices to talk to each other wirelessly, should be turned off on mobile devices carrying Secret or Top Secret information. This matters because leaving Bluetooth on can make it easier for hackers to sneak in and steal sensitive data that could compromise security.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect (Control Stack)

Preventative

Classifications

S, TS

ISM last updated

Dec 2021

Control Stack last updated

29 Sept 2026

E8 maturity levels

N/A

Guideline

Guidelines for enterprise mobility

Section

Mobile device usage

Topic

Using Bluetooth functionality

priority_high

Why it matters

Enabling Bluetooth on SECRET/TS mobile devices increases the risk of nearby interception, device compromise and data exfiltration over short-range links.

settings

Operational notes

Use MDM/device policies to disable Bluetooth on all SECRET/TS mobiles; regularly audit settings, record results and quarantine any non-compliant devices.

02 - Implement

build

Implementation tips

The IT team should audit all mobile devices used for handling Secret or Top Secret information to ensure Bluetooth is disabled. This can be done by accessing the device's settings and checking that Bluetooth is turned off.
Managers responsible for staff using mobile devices with sensitive information should communicate the importance of keeping Bluetooth off. They can do this by organising short training sessions explaining the risks and how to properly check the Bluetooth settings.
The Security Officer should create a policy that explicitly states Bluetooth must not be used on designated mobile devices. This policy should be distributed to all relevant personnel and included in onboarding materials.
Procurement teams should ensure that any new mobile devices purchased for handling sensitive information come with Bluetooth disabled by default. This can be confirmed with the supplier at the time of purchase.
HR should integrate a checklist into the onboarding process, which includes verifying that Bluetooth is disabled on any mobile device provided for handling sensitive information. This ensures new staff understand and comply with security requirements from day one.

03 - Audit

fact_check

Audit / evidence tips

AskThe device security settings report: Request documentation showing the configuration settings for each mobile deviceLook atThe Bluetooth settings sectionGoodIs confirmation that Bluetooth is turned off on all relevant devices
Look atThe attendance records and training contentGoodIncludes records showing completion by all relevant staff and materials emphasising Bluetooth risks
Look atA section that covers Bluetooth usage and its restrictionsGoodIncludes a clear policy statement that Bluetooth should remain off for devices handling sensitive information
AskRecords of procurement agreements: Review the terms of purchase for compliance with security specifications regarding Bluetooth settingsGoodIs agreements that specify devices must have Bluetooth turned off by default
GoodIs an updated, thorough checklist with a specific item about ensuring Bluetooth is disabled

04 - Mappings

link

Cross-framework mappings

How ISM-0682 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
layersPartially meets(2)expand_less
Annex A 8.1	ISM-0682 requires Bluetooth functionality is not enabled on SECRET and TOP SECRET mobile devices to reduce proximity-based compromise and...
Annex A 8.12	ISM-0682 requires Bluetooth functionality is not enabled on SECRET and TOP SECRET mobile devices to prevent data leakage via wireless pai...