ASD ISM 0866 Ensure privacy while viewing data in public
What it says
Sensitive or classified data is not viewed on mobile devices in public locations unless care is taken to reduce the chance of the screen of a mobile device being observed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDon't look at sensitive data on mobile devices in public unless you can shield your screen from others.
When you're looking at sensitive information on your smartphone or tablet in public, other people might be able to see what's on your screen. This can lead to your private or important company information getting into the wrong hands, which can cause all sorts of trouble like identity theft or company secrets being leaked.
Free. Save your status, tasks and notes.
Why it matters
Viewing sensitive data in public without shielding the screen can expose information to bystanders, causing data breaches.
How to implement
Managers should remind all employees about the importance of screen privacy.
They can do this by sending out regular email reminders or organising short workshops that explain why it's important and how to be cautious.
IT departments should provide privacy screen filters for devices.
These filters can be attached to screens to make it harder for people nearby to see the information unless they're directly in front of the screen.
Office administrators should include screen privacy as part of the regular onboarding process.
This will ensure that all new employees understand the importance of protecting screen data when out and about.
HR teams should develop clear guidelines for using mobile devices in public.
These guidelines should include examples of safe practices, like sitting with your back to a wall or using a privacy screen filter.
Team leaders should encourage employees to think about their surroundings when accessing sensitive information.
Hold brief team meetings to discuss how to judge whether a location is suitable for viewing confidential information.
Keep it running
In public, fit a privacy filter and angle the screen away from others; avoid viewing sensitive/classified data if you cannot.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A record of communications to staff about screen privacy measures.
Look at
Email dates and content or meeting agendas that show this topic was covered.
Good evidence
Evidence of regular communication with clear guidance on maintaining screen privacy.
- Check 2 of 5What an auditor asks for
Look at
The distribution log to see that these have been supplied to employees.
Good evidence
A list showing who has received a privacy filter and when.
- Check 3 of 5What an auditor asks for
Ask for
To see the employee onboarding checklist. Look to see if screen privacy and information security in public spaces are included.
Good evidence
A checklist item that notes screen privacy was covered with new hires.
- Check 4 of 5What an auditor asks for
Good evidence
Comprehensive guidelines that advise on public space data viewing.
- Check 5 of 5What an auditor asks for
Ask for
Records of team meetings or training sessions discussing prudent public practices.
Look at
Meeting notes or attendance records that confirm participation.
Good evidence
Consistent records showing employees were trained about screen privacy.
Mappings
Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.1.
ISM-0866 requires users to avoid viewing sensitive or classified information on mobile devices in public unless they can minimise the risk of screen observation. Annex A 8.1 mandates the protection of information stored on, processed by, or accessible via user endpoint devices, covering a wide range of endpoint protections. ISM-0866 functions as a specific confidentiality safeguard aimed at visual privacy within the broader scope of endpoint device protection outlined in Annex A 8.1.
This control partially overlaps A.7.7.
ISM-0866 requires that sensitive or classified data is not viewed on mobile devices in public locations unless steps are taken to reduce shoulder-surfing risk. Annex A 7.7 requires defined and enforced clear screen rules to prevent unauthorised viewing of information on screens in general. They overlap on preventing visual disclosure via screens, but ISM-0866 is specifically about mobile devices in public, while Annex A 7.7 is broader and typically focuses on workplaces and unattended terminals (e.g. locking screens).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.