ASD ISM 1198 Secure Bluetooth pairing for mobile devices
What it says
Bluetooth pairing for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices is performed in a manner such that connections are only made between intended Bluetooth devices.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure Bluetooth connections for devices are only made with intended, authorised equipment.
When you pair your mobile devices with Bluetooth, it's like making a new friend online. You want to be sure the person is who they say they are. If you're not careful, someone else could trick you into sharing things with them, putting your business and sensitive information at risk.
Free. Save your status, tasks and notes.
Why it matters
If Bluetooth pairing isn't secured, unintended devices may connect to mobile devices, enabling eavesdropping or data access and causing disruption.
How to implement
IT team should ensure Bluetooth is only turned on when needed: Before connecting any device, double-check that the other device's identity matches what you expect by checking the name and asking the user to confirm their device is trying to connect.
Managers should provide staff training on recognising authorised devices: Explain to employees which devices are trusted and how to verify them, such as checking device names and pairing requests carefully.
Procurement should maintain an inventory of authorised Bluetooth devices: Keep an up-to-date list of devices that are authorised to connect via Bluetooth, ensuring all devices in use are listed and checked regularly.
System owners should password-protect Bluetooth settings: Set up Bluetooth devices with security codes or PINs and instruct users to keep these codes private, ensuring only authorised devices can complete the pairing.
HR should update device usage policies: Include guidelines on Bluetooth usage in company policy, explaining the importance of accepting connections only from known devices and reporting any suspicious attempts.
Keep it running
Regularly review paired devices, remove unknown pairings, and keep Bluetooth off when not required to prevent connections to unintended devices.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of paired devices: Request a report of all devices that have been paired with company-owned devices through Bluetooth.
Look at
The device names and pairing dates.
Good evidence
List will have only known and approved devices without unexplained or unknown entries.
- Check 2 of 5What an auditor asks for
Ask for
Staff training records on device security: Request documentation showing when and how staff were trained on recognising and pairing with authorised Bluetooth devices.
Look at
Attendance sheets and training materials.
Good evidence
Record includes recent training for all relevant staff with clear, practical instructions.
- Check 3 of 5What an auditor asks for
Ask for
To see the device inventory: Request the latest inventory list of authorised Bluetooth devices.
Look at
Device names, types, and assigned users or departments. A well-maintained inventory will match the devices currently in use with up-to-date and correctly labelled entries.
- Check 4 of 5What an auditor asks for
Ask for
Policy documents on Bluetooth security: Request the company's policy on Bluetooth usage and security.
Look at
Guidelines about authorised devices and procedures for approving new devices. A strong policy will be clear, accessible, and understood by staff, outlining steps for safely pairing devices.
- Check 5 of 5What an auditor asks for
Ask for
System logs of Bluetooth activity: Request system logs or reports showing Bluetooth connection attempts.
Look at
Regular monitoring and review of these logs.
Good evidence
Record indicates recent reviews and actions taken when unauthorised connection attempts are detected.
Mappings
Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.1.
ISM-1198 requires Bluetooth pairing on non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices to be performed so connections are only made between intended Bluetooth devices. ISO/IEC 27001:2022 Annex A 8.1 requires protection of information stored on, processed by, or accessible via user endpoint devices, which includes controlling endpoint connectivity and peripheral/wireless interfaces to prevent unauthorised connections and data exposure. ISM-1198 is a technology-specific control that fits within Annex A 8.1's broader endpoint protection objective, but Annex A 8.1 also covers many other endpoint protections (e.g., configuration, malware protection, access control) beyond Bluetooth pairing.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.