ASD ISM 1083 Advise personnel on mobile communication sensitivity
What it says
Personnel are advised of the sensitivity or classification permitted for voice and data communications when using mobile devices.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPersonnel are informed about what levels of classified communication are allowed on mobile devices.
When using mobile devices, it's important to know what sensitive information is okay to discuss or send. If you don't set boundaries, there's a higher risk of leaking important data, which could result in legal troubles, loss of trust, or even financial damage.
Free. Save your status, tasks and notes.
Why it matters
Without clear guidance on mobile communication sensitivity, confidential data may be shared over mobile channels, causing exposure and breaches.
How to implement
Managers should define which types of sensitive information can be communicated over mobile devices.
To do this, they should work with their IT team to outline information categories based on sensitivity and decide if it's okay to discuss them over the phone or send via messaging apps.
The IT team should implement a training session for all personnel.
This session should clearly explain what levels of communication are appropriate for mobile use, providing examples and ensuring everyone understands how to apply these rules in real life.
HR should include guidelines on mobile communication in the employee induction program.
New employees should be made aware of what information is considered sensitive and the appropriate channels for sharing it.
System owners should regularly review and update the mobile communication policies.
This involves checking current technology capabilities and threats to ensure the guidelines are still relevant and effective.
The security officer should monitor and assess compliance with these guidelines.
They can do this by conducting random checks or surveys asking personnel about their knowledge and application of the rules.
Keep it running
Regularly brief personnel on permitted voice/data classifications on mobiles, refresh guidance after policy changes, and confirm understanding to prevent leaks.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The mobile communications policy document.
Look at
The outlined types of information and their allowed communication channels.
Good evidence
Clear classifications and explicit instructions on use for phone calls, emails, and apps.
- Check 2 of 5What an auditor asks for
Good evidence
Comprehensive records showing all current staff have attended within the past year.
- Check 3 of 5What an auditor asks for
Ask for
To see the induction checklist for new employees: Examine the sections detailing mobile communication guidelines.
Good evidence
Inclusion of up-to-date rules clearly explained in the checklist.
- Check 4 of 5What an auditor asks for
Look at
The frequency and findings of past reviews of the mobile communication policy.
Good evidence
Regular, at least annual, reviews and adjustments reflecting any new risks or technologies.
- Check 5 of 5What an auditor asks for
Ask for
The results of compliance checks or surveys: Evaluate the feedback collected on personnel's understanding and adherence.
Good evidence
Positive results indicating strong awareness and compliance, with action plans for any gaps.
Mappings
Closest match in ISO/IEC 27001: A.5.12, Information classification policy and practices, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.12.
Annex A 5.12 requires information to be classified so handling and communication align with its security needs and stakeholder requirements. ISM-1083 applies this to mobility by requiring personnel to be advised what sensitivity/classification is permitted for voice and data communications when using mobile devices. ISM-1083 is a narrow awareness/usage control for mobile communications, whereas Annex A 5.12 is broader and establishes the classification basis and organisation-wide practices.
This control partially meets A.6.3.
Annex A 6.3 requires role-appropriate awareness and regular updates to information security policy and topic-specific procedures. ISM-1083 is a specific awareness requirement to advise personnel about what sensitivity/classification is permitted for mobile voice and data communications. ISM-1083 would typically be delivered as part of the Annex A 6.3 program, but it does not cover the broader education/training program obligations.
This control partially overlaps A.5.10.
Annex A 5.10 requires organisations to document and implement acceptable use rules and handling procedures for information and assets. ISM-1083 overlaps by requiring personnel to be advised about what sensitivity/classification is permitted over mobile voice and data, which is an acceptable-use constraint for a particular communication context. ISM-1083 is more narrowly focused on classification guidance for mobile communications, while Annex A 5.10 additionally covers broader acceptable-use rules and asset handling procedures beyond mobile devices.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.