ASD ISM 0869 Encrypt storage on mobile devices
What it says
Mobile devices encrypt their internal storage and any removable media using ASD-approved cryptography.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMobile devices must use ASD-approved encryption for both internal and external storage.
This control ensures that mobile phones and tablets use government-approved techniques to lock away their data. Without proper encryption, if a device is lost or stolen, sensitive information could be at risk of exposure, leading to privacy breaches or financial loss.
Free. Save your status, tasks and notes.
Why it matters
Without encryption, lost or stolen mobile devices may lead to data breaches, endangering sensitive information and causing financial and reputational damage.
How to implement
The IT team should ensure all company-issued mobile devices have encryption enabled on their internal storage.
This can be done by checking the device settings and confirming encryption status.
Procurement should verify that any new devices support ASD-approved encryption before purchasing.
They can do this by consulting device specifications or seeking assurances from suppliers.
Managers should request regular checks from the IT team to ensure that any removable storage, like SD cards, is also using proper encryption methods.
This can be part of routine device audits.
HR should educate employees about the importance of using encryption and how it protects company data.
This can be included as part of the induction program or regular cyber security training sessions.
The IT team should use mobile device management (MDM) tools to enforce encryption policies.
These tools can ensure devices remain compliant with encryption standards and alert the team if issues arise.
Keep it running
Regularly update encryption policies and tools to reflect any new standards or threats to ensure ongoing protection of stored data.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the device encryption policy document: Request the written policy outlining how and why encryption is applied to devices.
Look at
specifics on encryption standards and enforcement mechanisms.
Good evidence
Comprehensive policy with references to ASD-approved encryption.
- Check 2 of 5What an auditor asks for
Ask for
a recent encryption status report: Request a report generated by the IT team or MDM tool showing current encryption status of all devices.
Look at
the report for compliance with encryption policies.
Good evidence
report shows all devices are compliant with no exceptions.
- Check 3 of 5What an auditor asks for
Ask for
training records: Request records showing employee training on the importance of encryption.
Look at
attendance records and training materials.
Good evidence
Documented training with employee attendance and up-to-date materials.
- Check 4 of 5What an auditor asks for
Ask for
procurement checklists: Request documentation showing the process for verifying device compliance before purchase.
Look at
items related to encryption capability assessments.
Good evidence
Documented checks confirming all devices have necessary encryption support.
- Check 5 of 5What an auditor asks for
Ask for
an audit trail from the MDM system: Request logs that show when devices were checked for encryption compliance.
Look at
recent entries indicating monitoring of this control.
Good evidence
Logs showing regular checks with no outstanding compliance issues.
Mappings
Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.1.
Annex A 8.1 requires protection of information stored on and accessible via user endpoint devices. ISM-0869 directly contributes by requiring encryption of mobile device internal storage and removable media, reducing the impact of device loss or unauthorised access. ISM-0869 is a subset of Annex A 8.1 because it addresses storage encryption on mobiles rather than comprehensive endpoint security across device types.
This control partially meets A.8.24.
ISM-0869 involves encrypting storage on mobile devices, a specific application of cryptography. ISO/IEC 27001:2022 Annex A 8.24 prescribes creating organisational rules for cryptographic use, thus ISM-0869's specific requirement enhances adherence to broader cryptographic governance.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.