ASD ISM 1088 Report potential compromises of mobile devices overseas
What it says
Personnel report the potential compromise of mobile devices, removable media or credentials to their organisation as soon as possible, especially if they: - provide credentials to foreign government officials - decrypt mobile devices for foreign government officials - have mobile devices taken out of sight by foreign government officials - have mobile devices or removable media stolen, including if later returned - lose mobile devices or removable media, including if later found - observe unusual behaviour of mobile devices.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishInform your employer immediately if your mobile device is compromised or shows unusual behaviour while overseas.
If you take your mobile device overseas and it acts strangely or gets handled by foreign officials, tell your boss right away. This is important because if your device is compromised, it could lead to sensitive information being stolen or misused, affecting both your privacy and your organisation's security.
Free. Save your status, tasks and notes.
Why it matters
If overseas device compromise isn't reported quickly, attackers may keep access to accounts, data and communications, enabling espionage and wider compromise.
How to implement
Employees should be trained to recognise signs of device compromise.
This involves participating in a brief training session or workshop where common signs like unexpected behaviour or unfamiliar apps are explained. Make sure training materials include real-world examples and are easy to understand.
Managers should establish a clear reporting process for device issues encountered overseas.
Develop a simple policy that employees can follow if their device is compromised. This might involve calling a designated IT contact immediately or filling out an online incident report form.
IT departments should create a checklist for employees to follow before travelling.
This checklist should include steps like installing security updates, backing up data, and setting strong passwords. The checklist can be distributed via email or as a downloadable document from the company's intranet.
HR should ensure that employees who travel have access to the necessary contact details.
Distribute an emergency contact list with relevant phone numbers or email addresses that employees can reach out to if their devices are compromised while overseas.
Security teams should regularly update the overseas mobile device policy.
This involves reviewing and refining policies based on past incidents and feedback from employees. Ensure that the revised policies are communicated clearly to all staff before travel.
Keep it running
Brief travellers to report immediately if foreign officials request credentials/decryption, take devices out of sight, or if devices/media are lost, stolen or act unusually.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The training materials used to educate employees about mobile device compromise.
Look at
The clarity and relevance of the content, ensuring it covers key behaviours to watch out for.
Good evidence
Includes up-to-date materials with real-life examples and evidence of recent training sessions.
- Check 2 of 5What an auditor asks for
Good evidence
Shows a simple, easy-to-follow document that is accessible to all employees.
- Check 3 of 5What an auditor asks for
Ask for
A copy of the pre-travel checklist provided to employees.
Look at
Whether it includes essential security steps like software updates and data backups.
Good evidence
Is a comprehensive list that has been distributed to all staff planning travel.
- Check 4 of 5What an auditor asks for
Good evidence
Shows that all contact information is up-to-date and that staff have been informed how to access it.
- Check 5 of 5What an auditor asks for
Ask for
Records of overseas mobile device policy reviews.
Look at
The frequency of reviews and any changes made to adapt to new threats.
Good evidence
Includes regularly updated policies with a documented review cycle and recent revisions based on feedback.
Mappings
Closest match in ISO/IEC 27001: A.5.24, Information security incident management planning and preparation, which this control covers in full and more.
ISO/IEC 27001: 2 mappings
This control is broader than A.5.24.
ISM-1088 requires personnel to report potential compromises of mobile devices, removable media or credentials quickly, especially when overseas indicators of compromise arise. ISO/IEC 27001:2022 Annex A 5.24 requires the organisation to plan and prepare incident management by defining processes, roles and responsibilities and communicating them. ISM-1088 is one specific behavioural/procedural reporting requirement that would sit within an Annex A 5.24 incident management framework, but it does not cover the full planning and preparedness scope.
This control partially overlaps A.6.8.
Annex A 6.8 requires mechanisms and defined channels for personnel and other relevant parties to report security events and suspected weaknesses promptly. ISM-1088 relates by requiring personnel to report potential compromises of mobile devices, removable media, or credentials (particularly in overseas travel scenarios) as soon as possible, which is an application of prompt reporting. ISM-1088 is narrower and scenario-specific, while Annex A 6.8 is broader and requires general-purpose reporting mechanisms across the organisation.
ASD Essential Eight: 2 mappings
This control partially overlaps E8-AH-ML2.16.
ISM-1088 requires personnel to rapidly report potential compromise of mobile devices, removable media, or credentials, particularly when travelling overseas and interacting with foreign officials or observing unusual device behaviour. E8-AH-ML2.16 requires cyber security incidents to be reported immediately to the CISO (or delegate) once they occur or are discovered. They overlap on the requirement for prompt incident reporting, but ISM-1088 is more specific to overseas mobile/credential compromise scenarios, while E8-AH-ML2.16 is broader on incident types but narrower on the mandated recipient (CISO).
This control partially overlaps E8-RA-ML2.11.
ISM-1088 requires personnel to rapidly report potential compromise of mobile devices, removable media, or credentials, particularly in overseas situations such as device seizure, forced decryption, or suspicious behaviour. E8-RA-ML2.11 requires cyber security incidents to be reported promptly to the CISO (or delegate) after occurrence or discovery. They overlap in driving timely reporting, but ISM-1088 is tailored to travel-related mobile/credential compromise triggers, whereas E8-RA-ML2.11 is a general reporting requirement focused on notifying the CISO.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.