ASD ISM 0871 Supervise mobile devices during active use
What it says
Mobile devices are kept under continual direct supervision when being actively used.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure mobile devices are watched carefully whenever they are in use to avoid loss or theft.
Whenever you're using your phone or tablet, you need to keep an eye on it. If you don't, someone might take it or you might misplace it. This matters because if someone else gets your device, they could access sensitive information or use it inappropriately.
Free. Save your status, tasks and notes.
Why it matters
Unsupervised mobile devices can be stolen or accessed by others during use, exposing sensitive data and causing breaches and reputational harm.
How to implement
Managers should remind employees to always keep their mobile devices in sight when using them.
This can be done during team meetings or through an email to staff, explaining why it's important for both personal safety and data security.
The IT team should implement software that alerts users if their screen isn't being watched, like requiring regular user confirmations.
They can configure devices to lock automatically if they're not actively used for a predefined period.
Office administrators should arrange for secure storage options, such as lockers, for employees to use when they're stepping away from their workstations.
They can coordinate with facilities management to ensure there's enough space and that employees know how to access it.
HR should include mobile device supervision guidelines in onboarding training.
This could involve a session or a tutorial where new employees learn about the potential risks of leaving devices unattended.
Security teams should conduct regular spot checks to see how well employees are following device supervision guidelines.
They can walk through areas where mobile devices are used and provide feedback or corrective action if necessary.
Keep it running
Train users to keep mobile devices in hand or in sight during active use, and never leave them unattended in public areas or shared spaces.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The employee handbook or training materials: Request sections that cover mobile device supervision.
Look at
How guidelines are communicated and whether training includes this information.
Good evidence
Is a detailed description with clear instructions and examples of acceptable and unacceptable behaviour.
- Check 2 of 5What an auditor asks for
Ask for
To see system logs or reports from device management software: Request records showing device usage and locking.
Look at
Whether devices automatically lock after a period of inactivity.
Good evidence
Shows a log with regular timestamps of device locks matching policy.
- Check 3 of 5What an auditor asks for
Ask for
To observe a security spot check plan: Request the schedule or report from spot checks. Look to see how often checks are done and how compliance is evaluated.
Good evidence
Includes a regular plan with feedback processes documented.
- Check 4 of 5What an auditor asks for
Ask for
Communication records regarding device supervision: Request emails or meeting notes sent to staff.
Look at
Frequency and clarity of communications around device security.
Good evidence
Shows periodic reminders, ideally with examples like screen captures of the messages.
- Check 5 of 5What an auditor asks for
Ask for
A list of security incidents involving mobile devices: Request incident logs related to unattended devices.
Look at
What incidents occurred and the follow-up actions taken.
Good evidence
Logs each incident with details, actions, and resolutions.
Mappings
Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.1.
ISM-0871 requires mobile devices to be kept under continual direct supervision when they are being actively used to reduce loss or theft. Annex A 8.1 requires protection of information stored on, processed by, or accessible via user endpoint devices, which includes mobile devices and extends beyond physical supervision to technical and administrative protections. ISM-0871 is one concrete physical/behavioural measure that contributes to endpoint device protection, but it does not cover the broader endpoint security controls implied by Annex A 8.1.
This control depends on A.6.7.
ISM-0871 requires mobile devices to be kept under continual direct supervision when they are being actively used to reduce loss or theft. Annex A 6.7 requires security measures for remote working to protect information accessed, processed or stored outside organisational premises, where mobile devices are frequently used in uncontrolled environments. Direct supervision of a mobile device during active use supports remote-working security by reducing opportunistic theft or unauthorised physical access, but Annex A 6.7 also covers broader remote-work controls (e.g. connectivity, handling practices, and technical safeguards).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.