ASD ISM 0870 Secure storage and handling of mobile devices
What it says
Mobile devices are carried or stored in a secured state when not being actively used.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure mobile devices are secure when not in use to prevent unauthorised access.
Keeping mobile devices like smartphones and tablets secure when they are not in use is crucial to prevent strangers from accessing sensitive information. If not managed, someone could easily pick up an unattended device and steal important data, leading to potential financial loss or privacy breaches.
Free. Save your status, tasks and notes.
Why it matters
Unsecured mobile devices can be lost or stolen, enabling unauthorised access to corporate apps/data and causing privacy breaches and financial loss.
How to implement
Managers should establish a policy for the secure storage of mobile devices.
They can instruct employees to always use password locks and keep devices in locked drawers or cabinets when not in use. Providing guidelines on locking screens automatically after a short period of inactivity is also helpful.
Business owners should ensure that all employees are aware of the risks of leaving devices unattended.
Conduct a short training session to demonstrate practical examples of secure device storage and have employees sign a form acknowledging their understanding.
IT teams should implement a remote management tool that can lock or wipe data from lost or stolen devices.
They can choose a reliable software solution that supports remote control features and educate users on how these features protect data.
Office managers should perform regular checks to ensure devices are being stored securely outside of office hours.
Create a checklist for closing procedures that includes securing all mobile devices and verify each task is completed nightly.
Procurement teams should standardise the type of mobile devices issued to employees.
They should purchase devices with built-in security features, such as biometric locks (fingerprint or facial recognition), to make securing them more intuitive and reliable.
Keep it running
Confirm devices auto-lock quickly, require PIN/biometric, and are stored in locked cabinets or secured with cable locks when not in active use.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The mobile device security policy document: Verify that a clear policy exists outlining secure storage requirements for devices when not in use.
Look at
Specific storage methods like locked cabinets or drawers.
Good evidence
Is a policy with clear instructions and examples of secure practices.
- Check 2 of 5What an auditor asks for
Ask for
To see the employee training attendance records.
Look at
Records showing who attended training on secure mobile device storage. Good evidence includes dates, attendee names, and signed acknowledgements of understanding security protocols.
- Check 3 of 5What an auditor asks for
Ask for
Documentation on remote management tools: Request reports or screen captures showing remote lock or data wipe capabilities. Look if these features are actively used. Good evidence is a report proving regular testing and readiness to use these features.
- Check 4 of 5What an auditor asks for
Ask for
To observe the office closing procedure: Watch how staff secure mobile devices at the end of the day. Look whether they follow the checklist and secure devices as described in policies. Good evidence is staff routinely storing devices securely with no exceptions.
- Check 5 of 5What an auditor asks for
Ask for
Procurement records on issued devices: Check that devices with recommended security features are provided to employees.
Look at
Model names and descriptions that mention features like biometrics. Good evidence includes a list of issued devices with security feature details.
Mappings
Closest match in ISO/IEC 27001: A.5.10, Acceptable use policies for information and assets, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.10.
ISM-0870 requires that mobile devices are carried or stored in a secured state when not being actively used, setting an operational security expectation for users. Annex A 5.10 supports this by requiring documented acceptable use and handling procedures for information and assets, which is the mechanism organisations typically use to define and enforce behaviours like locking, securing, and safely storing mobile devices. Annex A 5.10 is policy/procedure-oriented, while ISM-0870 is a specific handling requirement for mobile devices.
This control partially meets A.8.1.
Annex A 8.1 requires organisations to protect information stored on or accessible via endpoint devices. ISM-0870 addresses a key endpoint risk by requiring mobile devices to be carried or stored in a secured state when not in active use, helping prevent loss/theft and subsequent data compromise. ISM-0870 is narrower because it focuses on physical handling/storage, while Annex A 8.1 also includes technical controls and broader device protections.
This control partially overlaps A.7.7.
ISM-0870 requires mobile devices to be carried or stored in a secured state when not being actively used to reduce the risk of unauthorised access. This overlaps with Annex A 7.7 because clear screen rules commonly require locking screens when unattended, which is a practical way to keep a mobile device in a secured state. Annex A 7.7 is broader in that it also covers papers and removable media (clear desk) and applies to information processing facilities generally, not specifically mobile device storage/handling.
This control partially overlaps A.7.8.
ISM-0870 requires mobile devices to be carried or stored in a secured state when not being actively used to prevent unauthorised access. This overlaps with Annex A 7.8 because securely siting and protecting equipment includes ensuring devices are physically protected from theft or tampering when unattended, which is a common risk for mobile devices. However, Annex A 7.8 is about secure placement/protection of equipment generally, while ISM-0870 specifically targets the secured state and handling expectations for mobile devices.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.