ASD ISM 0687 Use approved platforms for secure mobile access
What it says
Mobile devices that access SECRET or TOP SECRET systems or data use mobile platforms that have been issued an Approval for Use by ASD and are operated in accordance with the latest version of their associated Australian Communications Security Instruction.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse only ASD-approved mobile platforms for accessing SECRET or TOP SECRET data.
For data that's really sensitive, like secret or top-secret government information, it's crucial to use mobile devices that have been checked and approved by experts in Australia. This is important because if we use insecure devices, there's a risk that confidential data could be stolen or leaked, which could lead to serious national security issues.
Free. Save your status, tasks and notes.
Why it matters
Using non-approved mobile platforms for SECRET data can lead to unauthorised access and severe national security breaches.
How to implement
Organisational leaders should ensure that only mobile devices approved by the Australian Signals Directorate (ASD) are used for accessing sensitive data.
This means verifying the ASD's list of approved devices and only procuring from that list.
IT teams should check that all mobile devices used for accessing secret and top-secret information are set up according to the latest Australian Communications Security Instruction.
This involves reviewing the setup instructions and applying all recommended security configurations.
Procurement officers need to collaborate with IT to ensure that when new devices are purchased, they are not only ASD-approved but also configured appropriately before use.
This can involve a checklist to ensure each device is compliant before distribution to users.
Managers should conduct regular training sessions for staff on the importance of using approved devices for sensitive information.
This can be done through workshops or informational emails that explain the risks and the expected practices.
Security teams should perform regular audits on the mobile devices being used to ensure compliance with ASD requirements.
This means checking device settings and software to verify they match the standards outlined in the security instructions.
Keep it running
Use only ASD Approval for Use mobile platforms for SECRET/TOP SECRET access, and operate them per the latest ACSI, including configuration and update requirements.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of mobile devices currently in use for accessing secret or top-secret data.
Look at
The types of devices and cross-check with the ASD's current list of approved platforms.
Good evidence
Is all devices matching the approved list and having recent certification dates.
- Check 2 of 5What an auditor asks for
Look at
Settings that align with the Australian Communications Security Instruction.
Good evidence
Shows these settings are up-to-date and conform to official guidance.
- Check 3 of 5What an auditor asks for
Ask for
Training records related to mobile device security.
Look at
Attendance and content covered during training sessions.
Good evidence
Includes comprehensive training covering ASD requirements and proof that all relevant staff attended.
- Check 4 of 5What an auditor asks for
Look at
Purchase orders and approval documents from IT that confirm device compliance.
Good evidence
Has clear records showing that only approved devices are procured.
- Check 5 of 5What an auditor asks for
Ask for
The results of recent audits on mobile device compliance.
Look at
The audit findings and any corrective actions taken.
Good evidence
Shows no significant issues were found, or if there were, they were promptly addressed.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
ISM-0687 requires that mobile devices used to access SECRET or TOP SECRET systems/data are on ASD-approved mobile platforms and operated per the relevant Australian Communications Security Instruction. Annex A 5.15 requires an organisation to establish and implement access control policies and procedures for physical and logical access based on business and security requirements. ISM-0687 is a specific, high-assurance implementation constraint for a particular access scenario (secure mobile access to classified systems) that would typically be expressed within an Annex A 5.15 access control policy framework.
This control partially meets A.8.1.
ISM-0687 requires ASD-approved mobile platforms for accessing SECRET or TOP SECRET systems or data, with operation aligned to the applicable Australian Communications Security Instruction. Annex A 8.1 requires protection of information stored on, processed by, or accessible via user endpoint devices, including mobile devices. ISM-0687 is a narrowly defined endpoint assurance requirement for classified mobile access, whereas Annex A 8.1 is broader and covers many endpoint protection measures beyond platform approval.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.