ASD ISM 1196 Keep mobile devices undiscoverable via Bluetooth
What it says
Non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices are configured to remain undiscoverable to other Bluetooth devices except during Bluetooth pairing.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishBluetooth on mobile devices is only discoverable during pairing to protect sensitive information.
This control means making sure your mobile device is hidden from other people's Bluetooth connections unless you're actively trying to pair it with something, like headphones or a car. It's important because, if left visible, someone nearby might connect to your device without you knowing, potentially accessing or stealing your personal data.
Free. Save your status, tasks and notes.
Why it matters
Exposing Bluetooth on devices can lead to unauthorised connections, risking sensitive data leakage or device control by malicious actors.
How to implement
The IT team should ensure Bluetooth settings for all employees' mobile devices are properly configured.
This can be done by providing standard directions on how to adjust Bluetooth settings so devices are not discoverable unless pairing. Implement these instructions as a checklist during device setup or updates.
Staff members need to be informed about the importance of keeping their Bluetooth settings set to 'hidden' unless actively pairing a device.
Hold a quick, engaging presentation to explain why, using simple examples, and demonstrate how to check their device settings.
Procurement officers should consider Bluetooth invisibility when selecting mobile devices for the organisation.
Ensure they verify with suppliers that devices can be set to remain undiscoverable by default. They should request a demonstration or documentation from the supplier that confirms this feature.
The IT support team should schedule regular audits of device settings.
Use a remote management tool that can verify Bluetooth discoverability settings across the organisation. Conduct these audits quarterly and document findings.
Managers should encourage a culture of security by including Bluetooth privacy tips in the monthly newsletter.
Provide a simple 'how-to' guide for making devices undiscoverable and include success stories to highlight compliance improvements within the team.
Keep it running
Regularly confirm Bluetooth remains undiscoverable except during pairing, particularly after OS updates, profile changes or device resets.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A report on device configuration: Request a list that shows the Bluetooth settings status of all mobile devices in the organisation.
Look at
Whether devices, especially those used for sensitive work, are set to be undiscoverable by default.
Good evidence
Is a majority compliance rate with remediation plans for non-compliant devices.
- Check 2 of 5What an auditor asks for
Ask for
The training materials: Review the presentation or guide used to educate staff about Bluetooth settings.
Look at
Clear instructions and examples that show why it's important to keep Bluetooth hidden.
Good evidence
Will have comprehensive, easy-to-understand materials with evidence of distribution, like attendance records or email logs.
- Check 3 of 5What an auditor asks for
Ask for
A procurement criteria list: Request the document that outlines what features are necessary when buying new mobile devices. Check if Bluetooth configuration capabilities are listed as a requirement.
Good evidence
Shows specific mention of Bluetooth discoverability settings, ensuring it can be configured as needed for security.
- Check 4 of 5What an auditor asks for
Ask for
A recent audit report: See the documentation from recent checks of Bluetooth settings across devices. Confirm the discovery of any issues and note the fixes which were implemented.
Good evidence
Outcome includes a high compliance rate and detailed plans for addressing any problems found.
- Check 5 of 5What an auditor asks for
Ask for
A survey or feedback summary: Request a summary of staff feedback or surveys about Bluetooth practices. Look into the feedback to ensure they understand and apply the proper settings.
Good evidence
Is positive feedback or plans to address misunderstandings, demonstrating continuous improvement.
Mappings
Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.1.
Annex A 8.1 requires protection of information accessible via user endpoint devices, including mobiles and tablets. ISM-1196 reduces exposure to nearby device attacks by requiring mobile devices to remain undiscoverable via Bluetooth except during pairing, which supports protecting data accessible on those endpoints. ISM-1196 is a specific wireless-hardening requirement and does not address the full range of endpoint security obligations in Annex A 8.1.
This control partially meets A.8.9.
ISM-1196 mandates a specific security configuration state for mobile devices: Bluetooth must be undiscoverable except during pairing. Annex A 8.9 requires organisations to establish, document, implement, monitor and review security configurations across hardware, software, services and networks, which would include enforcing Bluetooth discoverability settings via configuration management/MDM baselines. ISM-1196 is a single prescriptive configuration requirement, while Annex A 8.9 is the overarching process control for managing such configurations.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.