ASD ISM 1145 Apply privacy filters to protect device screens
What it says
Privacy filters are applied to the screens of SECRET and TOP SECRET mobile devices.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPrivacy filters help keep sensitive information on mobile screens private in public spaces.
Privacy filters on mobile devices make it hard for people nearby to see what's on your screen, which helps keep sensitive information secret when you're out in public. This is important because if someone glances at your screen and sees confidential details, it could lead to data breaches or misuse of that information.
Free. Save your status, tasks and notes.
Why it matters
Without privacy filters, SECRET/TOP SECRET screen content can be shoulder-surfed in public, enabling unauthorised disclosure, compromise, or espionage.
How to implement
Procurement should ensure all mobile devices, especially those handling SECRET or TOP SECRET data, have quality privacy filters.
They can select products from reliable vendors that meet governmental security specifications.
The IT team should install these privacy filters on all relevant mobile devices.
To do this, they should carefully apply the filter so it fits the screen properly without bubbles and doesn't affect touch sensitivity.
Managers should educate staff on the importance of using privacy filters.
They can do this by organising quick training sessions or sending out informative emails that explain how privacy filters protect sensitive information in public spaces.
Security officers should regularly check devices to ensure privacy filters remain effective.
This might involve inspecting devices periodically to ensure filters haven't been removed or damaged.
HR should incorporate privacy filter usage into the company policy for mobile devices.
They can draft a section in the mobile device policy that outlines when and where employees should use privacy filters.
Keep it running
Regularly inspect privacy filters on SECRET/TOP SECRET mobile devices for secure fit and wear; replace damaged filters promptly to maintain full screen coverage and prevent shoulder-surfing.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A procurement record of privacy filters: Request documentation showing purchase orders for privacy filters.
Look at
The quantity and specification of the filters bought.
Good evidence
Is to see orders matching the number of relevant devices with specifications suitable for SECRET and TOP SECRET use.
- Check 2 of 5What an auditor asks for
Ask for
A list of devices with installed privacy filters: Request this list from the IT team.
Look at
Whether all devices listed handle sensitive information and have the appropriate filters fitted.
Good evidence
Is completeness of all devices handling sensitive information listed with filters accounted for.
- Check 3 of 5What an auditor asks for
Ask for
Staff about their understanding of privacy filters' importance: Conduct brief interviews or surveys with employees.
Look at
Whether they understand how and why to use the filters, especially in public.
Good evidence
Is consistent responses showing awareness and proper filter usage.
- Check 4 of 5What an auditor asks for
Ask for
To see the training materials used for educating staff: Request copies or access to these materials.
Look at
The content for explaining the benefits and necessity of privacy filters.
Good evidence
Includes clear, practical instructions and examples relevant to device screen protection.
- Check 5 of 5What an auditor asks for
Ask for
The mobile device policy document: Request the company's written mobile device usage policy.
Look at
Sections that reference privacy filter use.
Good evidence
Includes clear guidelines on filter use and situations requiring discretion.
Mappings
Closest match in ISO/IEC 27001: A.7.7, Clear desk and clear screen policies, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.7.7.
ISM-1145 requires privacy filters on SECRET and TOP SECRET mobile device screens to reduce the risk of unauthorised viewing. ISO/IEC 27001:2022 Annex A 7.7 establishes and enforces clear screen rules to prevent sensitive information being visible when users leave devices unattended or in shared environments. Both reduce visual exposure of sensitive information on screens, but ISM-1145 mandates a specific protective mechanism for classified mobile devices whereas Annex A 7.7 focuses on behavioural and procedural controls across information processing facilities.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.