ASD ISM 0863 Prevent installation of unapproved mobile apps
What it says
Mobile devices prevent personnel from installing non-approved applications once provisioned.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMobile devices block users from installing apps that are not approved by the organisation.
This control makes sure that once a mobile device is set up for work, no one can install apps that the organisation hasn't approved. This is important because apps that aren't checked and approved could have security risks, like stealing data or crashing the device, which could lead to losing important business information or disrupting operations.
Free. Save your status, tasks and notes.
Why it matters
Unapproved apps on corporate mobiles can lead to data theft or disruptions, harming business continuity and exposing sensitive information.
How to implement
IT team should create a list of approved applications: Identify which apps are safe and necessary for business use and compile a list.
Then ensure this list is accessible to staff who manage mobile devices.
Mobile device manager should set restrictions: Use mobile device management (MDM) software to block installation of any apps not on the approved list.
The software should be set up to automatically enforce these restrictions each time an organisational device connects to the network.
HR or office manager should inform staff: Hold a brief training session to explain the importance of using only approved apps and the risks associated with unauthorised apps.
This ensures everyone understands and follows the policy.
Procurement should include app restrictions in device policies: When purchasing mobile devices, ensure contracts specify the need for app installation controls aligned with this policy.
This might involve working closely with suppliers to maintain these controls.
IT team should review apps regularly: Conduct periodic reviews to ensure the app list remains relevant and secure.
Remove any apps that are no longer safe or necessary, and update the list accordingly.
Keep it running
Use MDM to block non-approved apps after provisioning; alert on install attempts and review the approved app list regularly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of approved apps: Request the document that details all apps allowed for installation.
Look at
The apps' relevance to business tasks and any recent updates to the list.
Good evidence
Will show a current list with a date of last review and reasons for any changes.
- Check 2 of 5What an auditor asks for
Ask for
Device policy settings: Request a demonstration of the MDM settings on a sample mobile device.
Look at
The restrictions in place and ensure they align with the approved app list.
Good evidence
Shows strict controls preventing unapproved app installs.
- Check 3 of 5What an auditor asks for
Ask for
Staff training records: Request documentation showing training sessions for staff about app policies.
Look at
Frequency and comprehensiveness of the training.
Good evidence
Includes signed attendance, topics covered, and dates.
- Check 4 of 5What an auditor asks for
Ask for
Procurement policies: Request documents that outline procurement guidelines regarding device app restrictions.
Look at
Clauses that specify security measures for app installations.
Good evidence
Shows clear instructions aligned with this control.
- Check 5 of 5What an auditor asks for
Ask for
Recent audit or review reports: Request any recent audits or reviews about mobile device app installations.
Look at
Findings and any actions taken to address issues.
Good evidence
Highlights proactive measures taken based on the report's feedback.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML1.3, Ensure only approved applications and scripts can run, which this control covers in full and more.
ASD Essential Eight: 1 mapping
This control is broader than E8-AC-ML1.3.
ISM-0863 requires that provisioned mobile devices prevent personnel from installing non-approved mobile applications. E8-AC-ML1.3 requires application control to restrict execution of software (including installers) to an organisation-approved set, which is a broader application control objective that can include (but is not limited to) mobile app installation restrictions. ISM-0863 is specifically about mobile app installation on mobile devices, whereas E8-AC-ML1.3 covers execution control across many artefact types and environments.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.