ASD ISM 1085 Encrypt sensitive data over public networks
What it says
Mobile devices encrypt all sensitive or classified data communicated over public network infrastructure using ASD-approved cryptography.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMobile devices must encrypt sensitive data sent over public networks using approved cryptography.
This control means that any sensitive information sent from mobile devices over public Wi-Fi, like at a cafe or airport, needs to be encrypted using safe methods approved by the Australian Signals Directorate (ASD). This is important because if your information isn't protected, it can be intercepted by others, leading to data theft and potential harm to your business.
Free. Save your status, tasks and notes.
Why it matters
Failing to encrypt data on public networks can result in data breaches, leading to financial loss and damage to your reputation.
How to implement
IT team should configure mobile devices to automatically use encryption when sending data over the internet.
This can be done by ensuring all mobile apps use secure communication protocols.
Managers should educate staff on the importance of using secure networks and ensuring their apps are updated to the latest versions, which often include security improvements.
Procurement officers should ensure that devices purchased have the capability to support ASD-approved encryption standards, by checking with vendors before purchase.
System administrators should regularly audit device settings to verify encryption protocols are in place and functioning correctly.
This involves checking device settings or using management software to automate compliance checks.
Training coordinators should arrange for regular training sessions for employees to understand what encryption is and why they must ensure their devices comply with these requirements.
Keep it running
Consistently monitor mobile devices to ensure they maintain compliance with encryption standards, adapting policies and training as needed.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the list of mobile devices used across the organisation.
Look at
Check that the list matches the device inventory and records each device's encryption capabilities.
Good evidence
The list reconciles with the inventory and identifies which devices can encrypt sensitive or classified data with ASD-approved cryptography.
- Check 2 of 5What an auditor asks for
Ask for
Request the encryption policy document.
Look at
Look for the encryption standards specified for mobile devices communicating over public networks and the ASD approval details.
Good evidence
The policy clearly states which ASD-approved protocols are mandatory for sensitive or classified data sent over public network infrastructure.
- Check 3 of 5What an auditor asks for
Ask for
Ask for logs or reports from the mobile device management software.
Look at
Review the entries that show whether devices comply with the required encryption settings.
Good evidence
Records show regular compliance checks, with any non-compliant devices flagged and the issues resolved.
- Check 4 of 5What an auditor asks for
Ask for
Request training attendance records for staff involved in handling sensitive or classified data.
Look at
Confirm that these staff have attended encryption and security training.
Good evidence
Records include names, dates and details of the training covering encryption of data on mobile devices.
- Check 5 of 5What an auditor asks for
Ask for
Ask for a demonstration of encryption on a sample mobile device.
Look at
Observe whether the device is configured in line with the policy and check the encryption settings applied to data sent over public networks.
Good evidence
The device is securely configured and encrypts sensitive or classified data with ASD-approved cryptography as the policy requires.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
ISM-1085 requires mobile devices to encrypt sensitive or classified data when it is communicated over public network infrastructure. Annex A 8.20 requires networks and network devices to be secured, managed and controlled to protect information in systems and applications, which includes implementing secure network services (e.g. VPNs, secure Wi-Fi, and secure remote access) that mobile devices rely on when traversing public networks. Annex A 8.20 is broader and network-centric, while ISM-1085 is a specific endpoint transmission-encryption requirement for mobile devices over public networks.
This control partially meets A.8.24.
ISM-1085 requires mobile devices to encrypt sensitive or classified data when communicating over public network infrastructure. Annex A 8.24 establishes organisation-wide rules for the effective use of cryptography and key management, under which requirements such as mandating TLS, VPN encryption, certificate use, and approved ciphers for mobile communications would be defined. ISM-1085 is a specific use-case within the broader cryptography and key management governance of Annex A 8.24.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.