Skip to content
Enterprise mobility
ASD ISMISM-1082

ASD ISM 1082 Develop and maintain mobile device usage policy

What it says

A mobile device usage policy is developed, implemented and maintained.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure a policy is in place to guide how mobile devices are used in the organisation.

This control is about having a clear policy for how mobile devices are used in your organisation. Imagine if your staff could just use their phones to access company data without any rules; it could lead to security risks if a device is lost or stolen. A proper policy helps protect sensitive information and ensures everyone knows what's allowed and what's not.

Why it matters

Without a mobile device usage policy, unmanaged BYOD and app use can expose sensitive data via loss/theft, insecure apps, or unauthorised access.

How to implement

  1. The management team should draft the mobile device usage policy to set the rules for using phones and tablets at work.

    Start by deciding what types of data employees can access from their devices and how they should protect it. Involve your IT team to cover technical requirements like passwords and software updates.

  2. IT staff should ensure all mobile devices accessing company data have security measures like encryption and regular updates.

    This can be done by setting up a central management tool to enforce these protections automatically. Regular checks should be scheduled to verify compliance.

  3. HR should include the new mobile device policy in onboarding sessions.

    New hires need clear guidance, so explain the policy during their first week and ensure they sign off to confirm understanding. This approach establishes expectations early.

  4. Managers should periodically remind their teams about the mobile device policy, especially when changes are made.

    Set up brief reminders in team meetings or via email whenever there's an update to ensure everyone remains informed.

  5. The IT department should conduct quarterly reviews of the mobile device usage policy to ensure it remains relevant.

    This involves checking for new security threats or changes in technology that might require updates. Collaborate with management to approve any necessary revisions.

Keep it running

Review the mobile device usage policy at least annually; cover BYOD eligibility, MDM enrolment, app allow/deny lists, encryption, lock screens and reporting lost devices.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The mobile device usage policy document: Request a copy of the official policy that governs mobile device use in the organisation. Look to see if it covers areas like permitted apps, data protection measures, and device management procedures.

    Good evidence

    Is a comprehensive document with clear, concise guidelines that address security and usage expectations.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Records of policy communication: Request evidence such as emails or meeting minutes showing how the policy has been communicated to staff.

    Look at

    Distribution dates and any acknowledgement from employees.

    Good evidence

    Includes both initial distribution and any updates communicated to all relevant staff.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Records of onboarding sessions: Request documentation or presentations used in onboarding that include the mobile device policy section.

    Look at

    Signed acknowledgements from new employees.

    Good evidence

    Outcome is having these records indicate consistent delivery of the policy to new team members.

  4. Check 4 of 5What an auditor asks for

    Ask for

    To see the mobile device management dashboard: Request a demonstration of the system that enforces security measures on mobile devices.

    Look at

    The ability to update, encrypt, and secure data on devices.

    Good evidence

    System shows active management and compliance with the policy.

  5. Check 5 of 5What an auditor asks for

    Ask for

    The last policy review report: Request the most recent evaluation of the mobile device usage policy.

    Look at

    Notes on changes made and any relevant approvals from senior management.

    Good evidence

    Is a consistently reviewed policy with updates made based on current threats and organisational needs.

Mappings

Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.1Protection of user endpoint devicesPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.