ASD ISM 0694 Block privately owned devices from SECRET and TOP SECRET systems
What it says
Privately owned mobile devices and desktop computers do not access SECRET and TOP SECRET systems or data.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPersonally owned mobile devices and desktop computers must never be used to access SECRET or TOP SECRET systems or the data held in them.
This control means that personal phones, tablets and home computers (any device owned by an individual rather than the organisation) are not allowed to connect to or open systems and information classified as SECRET or TOP SECRET. SECRET and TOP SECRET are the two highest government security classifications, used for information that could cause serious or exceptionally grave damage if exposed. Personal devices cannot be properly checked, locked down or monitored, so allowing them near such sensitive systems creates an unacceptable risk of leaks.
Free. Save your status, tasks and notes.
Why it matters
If a personal phone or home computer connects to SECRET or TOP SECRET systems, highly classified information can leak through an uncontrolled device, causing serious or exceptionally grave national security damage.
How to implement
The IT or security manager should configure the SECRET and TOP SECRET systems so they only accept connections from a register of organisation-owned, hardened devices, and reject any device not on that list.
The system owner should publish a written policy stating plainly that no privately owned mobile device or desktop computer may access SECRET or TOP SECRET systems or data, and have all staff who use these systems sign it.
IT administrators should issue government or organisation-owned devices to anyone who needs to work with SECRET or TOP SECRET material, so staff never have a reason to reach for a personal device.
The security team should physically separate the areas and networks where SECRET and TOP SECRET systems live, controlling entry so personal phones and laptops cannot be plugged in or connected.
Managers should run a clear-desk and device-check routine before staff enter SECRET or TOP SECRET work areas, collecting or excluding personal devices at the door.
Keep it running
Keep the device register current as hardware is added or retired, and re-check the technical and physical blocks whenever the classified systems or their network change.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the access control configuration or device register for the SECRET and TOP SECRET systems.
Look at
whether only organisation-owned devices are listed and whether unknown devices are actively blocked.
Good evidence
shows a maintained allow-list and evidence that non-listed devices are refused connection.
- Check 2 of 5What an auditor asks for
Ask for
the written policy banning privately owned devices from these systems.
Look at
whether it names both mobile devices and desktop computers and both SECRET and TOP SECRET classifications.
Good evidence
is a current, signed-off policy that staff have acknowledged.
- Check 3 of 5What an auditor asks for
Ask for
how staff are given the tools to do classified work.
Look at
issue records for organisation-owned devices assigned to relevant users.
Good evidence
shows every user of these systems has an official device, removing any need for a personal one.
- Check 4 of 5What an auditor asks for
Ask for
evidence of the controls that stop personal devices physically connecting.
Look at
network port controls, entry procedures and any device-detection logs.
Good evidence
shows layered measures (technical and physical) rather than relying on staff goodwill alone.
- Check 5 of 5What an auditor asks for
Ask for
any records of attempted or actual access by unauthorised personal devices.
Look at
the logs and how each event was handled.
Good evidence
shows either no such events or prompt detection and follow-up where one occurred.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.15.
ISM-0694 mandates that privately-owned devices are not permitted to access SECRET and TOP SECRET systems or data. Annex A 5.15 requires organisations to establish and implement rules for physical and logical access based on business and security requirements, which would include defining BYOD and classified network access rules. ISM-0694 is a specific rule within the broader policy/procedure framework required by Annex A 5.15.
This control partially meets A.6.7.
Annex A 6.7 addresses protecting information when personnel work remotely, including controlling which devices can access organisational systems from outside premises. ISM-0694 prohibits privately-owned devices from accessing SECRET and TOP SECRET systems or data, directly constraining high-risk remote access paths. ISM-0694 is a narrow prohibition for high classifications, while Annex A 6.7 encompasses remote working security for all relevant information classifications and scenarios.
This control partially meets A.8.3.
ISM-0694 requires an explicit prohibition on privately-owned devices accessing SECRET and TOP SECRET systems or data. Annex A 8.3 is a broader access control requirement to restrict access to information and assets in accordance with policy, under which a 'no BYOD to SECRET/TOP SECRET' rule would be implemented. ISM-0694 is therefore a specific, classification-driven access restriction within the wider access restriction intent of Annex A 8.3.
This control supports A.5.12.
ISM-0694 enforces an access restriction specifically tied to SECRET and TOP SECRET classifications and to privately-owned devices. Annex A 5.12 is a prerequisite in practice because classification policy and practices define what information is SECRET/TOP SECRET and how it must be handled, enabling ISM-0694 to be applied consistently. Annex A 5.12 is broader while ISM-0694 is one resulting access prohibition for high classifications.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.