ASD ISM 1195 Enforce policy with evaluated mobile device management
What it says
Mobile Device Management solutions that have completed a Common Criteria evaluation against the Protection Profile for Mobile Device Management, version 4.0 or later, are used to enforce mobile device management policy.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse certified management solutions to ensure mobile devices follow security policies.
This control ensures that mobile devices, like phones and tablets used for work, are managed by trustworthy software that follows strict Australian standards for security. If this isn't done, sensitive business information could be at risk if, for example, a device is lost or hacked.
Free. Save your status, tasks and notes.
Why it matters
Without a Common Criteria evaluated MDM (PP v4.0+), policy enforcement may fail, increasing loss or compromise risks from stolen or unmanaged mobile devices.
How to implement
The IT manager should select a Mobile Device Management (MDM) solution that meets the Australian Common Criteria for security.
This involves researching and selecting from certified solutions that comply with the latest version of the Protection Profile for MDM systems.
IT staff must enrol all company mobile devices into the chosen MDM system.
They can do this by following the setup guide provided by the MDM vendor, which typically includes installing an app on each device and configuring settings through a central console.
The IT team should regularly update the MDM system to ensure it includes the latest security patches and policy updates.
This can be done by setting up automatic updates in the MDM software or scheduling regular manual checks.
Management should conduct training sessions for all employees on the importance of MDM policies.
This can be achieved by organising workshops where the IT team explains how devices are managed and why it's crucial for security.
HR should coordinate with IT to ensure that new employees have their mobile devices set up with the MDM solution as part of their onboarding process.
This involves creating a checklist that includes MDM enrolment as a mandatory step.
Keep it running
Confirm the MDM product remains Common Criteria evaluated against the MDM PP v4.0+ and enforce enrolment, compliance checks and remote wipe for all managed mobile devices.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The MDM certification documentation: Request the certification papers that prove the MDM solution meets the Australian Common Criteria.
Look at
The dates and version numbers on the documents.
Good evidence
Is documents that are current and clearly state compliance with the relevant standards.
- Check 2 of 5What an auditor asks for
Ask for
To see the list of all enrolled devices: Request a report that lists all mobile devices currently managed by the MDM.
Look at
Whether the device list matches active employees and expected equipment.
Good evidence
All business devices are listed, with enrolment dates and last check-in times.
- Check 3 of 5What an auditor asks for
Ask for
Security policy compliance reports from the MDM: Request regular reports generated by the MDM showing policy compliance status.
Look at
Compliance status details per device.
Good evidence
Reports that show consistent policy adherence across devices, with alerts for non-compliance being promptly addressed.
- Check 4 of 5What an auditor asks for
Ask for
Records of MDM updates: Request logs or change records showing when the MDM system was last updated.
Look at
The frequency and details of these updates.
Good evidence
Shows regular update patterns aligned with vendor release cycles, indicating active maintenance.
- Check 5 of 5What an auditor asks for
Ask for
To observe a device being set up: Request a demonstration of the MDM enrolment process for a new device.
Look at
Steps followed during the setup and any automated checks done.
Good evidence
A clear step-by-step process that includes device recognition by the MDM and confirmation of policy application.
Mappings
Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.1.
Annex A 8.1 requires protection of information on user endpoint devices, which commonly relies on consistent configuration and policy enforcement. ISM-1195 requires the use of evaluated Mobile Device Management (MDM) to enforce mobile device management policy, directly supporting secure configuration and control of mobile endpoints that store or access organisational data. ISM-1195 is narrower because it focuses on an MDM assurance/enforcement mechanism for mobiles, while Annex A 8.1 covers all endpoint protections more generally.
This control supports A.5.21.
ISM-1195 requires organisations to enforce mobile device policy using an MDM solution that has passed a Common Criteria evaluation against the MDM Protection Profile. Annex A 5.21 addresses ICT supply chain security risk management for products and services, which includes assurance activities when procuring and operating security tooling like MDM. The controls align where Common Criteria evaluation is used as supply-chain assurance evidence, but Annex A 5.21 extends to the full supply chain lifecycle and multiple suppliers, not just MDM capability.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.