Skip to content
Enterprise mobility
ASD ISMISM-0702

ASD ISM 0702 Using cryptographic sanitisation on mobile devices

What it says

If a cryptographic zeroise or sanitise function is provided for cryptographic keys on a SECRET or TOP SECRET mobile device, the function is used as part of mobile device emergency sanitisation processes and procedures.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensures cryptographic keys are erased on SECRET or TOP SECRET devices in emergencies.

If you have a mobile device that contains highly sensitive information, like national security secrets, it's vital to be able to quickly erase encryption keys in an emergency. This is important because keeping these keys on the device means someone could unlock and access that sensitive information if they got their hands on it.

Why it matters

Failing to zeroise keys swiftly can expose SECRET/TOP SECRET data if a mobile device is lost or stolen, risking national security.

How to implement

  1. Managers responsible for mobile devices should identify which devices hold SECRET or TOP SECRET information.

    They should make a list of these devices and regularly update it to ensure all are accounted for.

  2. The IT team should enable cryptographic zeroise or sanitisation functions on applicable devices.

    This means setting up the devices so that, in an emergency, these functions can quickly erase the cryptographic keys.

  3. IT security staff should develop and document an emergency procedure for using the zeroise or sanitisation function.

    This includes instructions on when and how to use it, and who is authorised to conduct this action in various scenarios.

  4. Training personnel who handle SECRET or TOP SECRET devices is crucial.

    The IT team should conduct practice sessions where employees learn to engage the emergency cryptographic functions, so they are prepared to act quickly if needed.

  5. Managers should regularly review these procedures and update them as technology or organisation needs change.

    Scheduling a semi-annual review can ensure that the processes remain relevant and effective.

Keep it running

Regularly test the cryptographic zeroise/sanitise function on the device and ensure it is embedded in emergency sanitisation procedures for rapid use.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The list of all devices classified as SECRET or TOP SECRET: It should be regularly updated.

    Look at

    Any recently added or removed devices and ensure there is a date and signature for the latest review.

    Good evidence

    Shows a clear, current list with appropriate sign-offs.

  2. Check 2 of 5What an auditor asks for

    Look at

    Clear evidence that the zeroise or sanitisation functions are enabled.

    Good evidence

    Provides easy-to-understand proof of these settings being utilised.

  3. Check 3 of 5What an auditor asks for

    Ask for

    To see the emergency procedure documentation: Verify that it includes steps for activating the cryptographic sanitisation. Check that the names of authorised individuals and conditions under which this should be performed are listed.

    Good evidence

    Outlines clear, concise steps with designated responsible personnel.

  4. Check 4 of 5What an auditor asks for

    Look at

    Recorded attendance, topics covered, and feedback from participants.

    Good evidence

    Includes a comprehensive training schedule with attendee lists and feedback.

  5. Check 5 of 5What an auditor asks for

    Look at

    A documented schedule and evidence of past reviews taking place.

    Good evidence

    Is a calendar or log showing future and past review dates, with improvement actions noted if necessary.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which partially overlaps with this control.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.