ASD ISM 0682 Disable Bluetooth on SECRET/TS mobile devices
What it says
Bluetooth functionality is not enabled on SECRET and TOP SECRET mobile devices.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishBluetooth must be turned off on mobile devices with SECRET or TOP SECRET information to prevent data leaks.
This control means that Bluetooth, a way for devices to talk to each other wirelessly, should be turned off on mobile devices carrying Secret or Top Secret information. This matters because leaving Bluetooth on can make it easier for hackers to sneak in and steal sensitive data that could compromise security.
Free. Save your status, tasks and notes.
Why it matters
Enabling Bluetooth on SECRET/TS mobile devices increases the risk of nearby interception, device compromise and data exfiltration over short-range links.
How to implement
The IT team should audit all mobile devices used for handling Secret or Top Secret information to ensure Bluetooth is disabled.
This can be done by accessing the device's settings and checking that Bluetooth is turned off.
Managers responsible for staff using mobile devices with sensitive information should communicate the importance of keeping Bluetooth off.
They can do this by organising short training sessions explaining the risks and how to properly check the Bluetooth settings.
The Security Officer should create a policy that explicitly states Bluetooth must not be used on designated mobile devices.
This policy should be distributed to all relevant personnel and included in onboarding materials.
Procurement teams should ensure that any new mobile devices purchased for handling sensitive information come with Bluetooth disabled by default.
This can be confirmed with the supplier at the time of purchase.
HR should integrate a checklist into the onboarding process, which includes verifying that Bluetooth is disabled on any mobile device provided for handling sensitive information.
This ensures new staff understand and comply with security requirements from day one.
Keep it running
Use MDM/device policies to disable Bluetooth on all SECRET/TS mobiles; regularly audit settings, record results and quarantine any non-compliant devices.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The device security settings report: Request documentation showing the configuration settings for each mobile device.
Look at
The Bluetooth settings section.
Good evidence
Is confirmation that Bluetooth is turned off on all relevant devices.
- Check 2 of 5What an auditor asks for
Look at
The attendance records and training content.
Good evidence
Includes records showing completion by all relevant staff and materials emphasising Bluetooth risks.
- Check 3 of 5What an auditor asks for
Look at
A section that covers Bluetooth usage and its restrictions.
Good evidence
Includes a clear policy statement that Bluetooth should remain off for devices handling sensitive information.
- Check 4 of 5What an auditor asks for
Ask for
Records of procurement agreements: Review the terms of purchase for compliance with security specifications regarding Bluetooth settings.
Good evidence
Is agreements that specify devices must have Bluetooth turned off by default.
- Check 5 of 5What an auditor asks for
Good evidence
Is an updated, thorough checklist with a specific item about ensuring Bluetooth is disabled.
Mappings
Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.1.
ISM-0682 requires Bluetooth functionality is not enabled on SECRET and TOP SECRET mobile devices to reduce proximity-based compromise and uncontrolled short‑range data transfer. This aligns with Annex A 8.1, which requires protection of information on user endpoint devices through appropriate configuration and hardening, including disabling unnecessary interfaces on mobile endpoints. ISM-0682 is a highly prescriptive endpoint configuration requirement for a specific radio interface and classification context, whereas Annex A 8.1 is broader and covers the full set of endpoint protections (e.g. secure configuration, protection of stored data, and endpoint controls) across device types.
This control partially meets A.8.12.
ISM-0682 requires Bluetooth functionality is not enabled on SECRET and TOP SECRET mobile devices to prevent data leakage via wireless pairing and short-range communications. This relates to Annex A 8.12, which requires data leakage prevention measures for systems, networks and devices that process, store or transmit sensitive information, including restricting unauthorised data transfer channels. ISM-0682 is a single, preventative DLP control focused on eliminating one exfiltration path (Bluetooth) on high-classification mobile devices, while Annex A 8.12 is broader and can include policy, monitoring, detection and enforcement across multiple leakage vectors.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.