ASD ISM 1084 Transporting mobile devices securely
What it says
If unable to carry or store mobile devices in a secured state, they are physically transferred in a security briefcase or an approved multi-use satchel, pouch or transit bag.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishIf you can't secure a mobile device, it must be carried in a security bag or similar for safe transport.
This control is all about making sure our mobile devices, like phones and tablets, are kept safe when we move them around, especially if they're not already secured by a passcode or other means. If they're not properly guarded, they have to be carried in a special security bag. This matters because if a device is lost or stolen, sensitive information could fall into the wrong hands, leading to privacy breaches or financial loss.
Free. Save your status, tasks and notes.
Why it matters
If mobile devices are transported without an approved security bag, they may be lost or stolen, enabling access to sensitive data and system accounts.
How to implement
Employees responsible for handling sensitive information should ensure that all mobile devices are locked with a passcode or equivalent security measure before transport.
This could involve setting up a device password or implementing biometric security, like fingerprint recognition.
IT teams should conduct training sessions for all staff on secure transportation practices for mobile devices.
This includes demonstrating how to use security pouches and reminding employees about the importance of these measures.
Procurement departments should include security storage options in their purchasing requirements for mobile devices.
This means only buying devices with security-compatible accessories or having pre-approved security bags that are readily available for staff use.
Supervisors should regularly remind staff to use designated security pouches when transporting devices by incorporating this into team meetings or regular communications.
Quarterly check-ins can help reinforce the policy and identify any challenges in compliance.
Keep it running
When devices cannot be carried or stored securely, transport them only in an approved security briefcase, satchel, pouch or transit bag and keep them attended.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Training materials on secure mobile device transport.
Look at
The content of the training to ensure it includes measures for using security bags.
Good evidence
Is a comprehensive guide that includes steps for securing and carrying devices.
- Check 2 of 5What an auditor asks for
Ask for
A list of approved security bags available to staff.
Look at
The specifications of these bags to confirm they meet industry standards for security.
Good evidence
Will show that bags are tamper-evident and securely lockable.
- Check 3 of 5What an auditor asks for
Ask for
A record of security bag distribution to employees. Look to see if each device case assignment is documented with names and dates.
Good evidence
Is a log showing regular, consistent provision and use of security bags.
- Check 4 of 5What an auditor asks for
Ask for
To see any incident reports involving lost or stolen mobile devices.
Look at
The details to check if a security bag was used.
Good evidence
Will show that incidents are low and involve proper use of security bags.
- Check 5 of 5What an auditor asks for
Ask for
Feedback collection from employees about the use of security bags.
Look at
Any comments that indicate issues or improvements.
Good evidence
Includes actionable insights that lead to better usage practices.
Mappings
Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.1.
ISM-1084 addresses physical protection during transport by mandating approved security bags when a mobile device cannot otherwise be secured. Annex A 8.1 requires organisations to protect information stored on, processed by, or accessible via user endpoint devices, which includes mobile devices across many protection domains. ISM-1084 is one concrete physical-handling measure that can be used to help meet Annex A 8.1, but Annex A 8.1 also expects broader technical and administrative protections beyond transport.
This control depends on A.6.7.
ISM-1084 requires secure physical transport of mobile devices using approved security bags when the devices cannot be otherwise secured. Annex A 6.7 requires security measures for remote working to protect information when accessed, processed, or stored outside the organisation's premises. ISM-1084 supports Annex A 6.7 by reducing the likelihood of loss or theft of devices while travelling to/from remote locations, but Annex A 6.7 also covers remote access, environment and procedural controls that ISM-1084 does not address.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.