ASD ISM 1199 Remove unnecessary Bluetooth pairings on devices
What it says
Bluetooth pairings for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices are removed when there is no longer a requirement for their use.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRemove Bluetooth pairings on certain mobile devices when they are no longer needed.
This control is about managing Bluetooth connections on mobile devices like smartphones and tablets. It's important because if you leave old Bluetooth pairings active, someone with bad intentions could connect to your device without you knowing, especially if those devices handle sensitive information. Removing unnecessary connections helps keep your information secure.
Free. Save your status, tasks and notes.
Why it matters
If unnecessary Bluetooth pairings remain, nearby devices may reconnect or be spoofed, enabling unauthorised access or data exposure on mobile devices.
How to implement
IT team should review Bluetooth pairings regularly: Check the Bluetooth settings on all work mobile devices to remove any pairings that are no longer needed.
Do this by accessing the Bluetooth menu and selecting the 'Forget' or 'Remove' option for outdated devices.
Office manager should remind staff: Send a monthly reminder email to all staff asking them to check and clean up Bluetooth connections on their work devices.
Provide simple instructions on how to do this step-by-step.
System administrator should enforce pairing policies: Create a policy that requires automatic disconnection of inactive Bluetooth devices after a certain period.
Configure device settings to ensure this is applied uniformly across all organisation devices.
Security officer should verify device compliance: Regularly audit mobile devices to ensure old Bluetooth connections have been removed.
Use device management software to help track and report compliance.
Training lead should educate staff: Conduct quarterly training on the risks of unused Bluetooth connections and how to safely manage them.
Use real-world examples to illustrate potential security breaches from old pairings.
Keep it running
Review saved Bluetooth pairings on OFFICIAL: Sensitive and PROTECTED mobile devices and delete any that are no longer required, including after staff or device changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The Bluetooth management policy: Request the document outlining how Bluetooth connections are handled on mobile devices.
Look at
The specific steps for removing old pairings.
Good evidence
Includes clear instructions and timelines for reviewing connections.
- Check 2 of 5What an auditor asks for
Ask for
Device activity logs: Request logs from the device management system showing Bluetooth activity.
Look at
Entries for unpairing events.
Good evidence
Includes regular unpairing actions that align with the policy.
- Check 3 of 5What an auditor asks for
Ask for
Staff training records: Request records showing staff attendance at relevant training sessions.
Look at
Names, dates, and content covered.
Good evidence
Is consistent staff participation and relevant training materials.
- Check 4 of 5What an auditor asks for
Ask for
Security audit reports: Request recent audit results that include checks on Bluetooth pairings.
Look at
Any issues raised and how they were resolved.
Good evidence
Includes few or no instances of outdated pairings being flagged.
- Check 5 of 5What an auditor asks for
Ask for
Mobile device compliance reports: Require reports on the status of Bluetooth settings across all devices.
Look at
Compliance percentages and follow-up actions for non-compliance.
Good evidence
Shows high compliance rates and proactive follow-up.
Mappings
Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.1.
ISM-1199 requires Bluetooth pairings to be removed from non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices when they are no longer required. This relates to Annex A 8.1 because removing unnecessary Bluetooth pairings reduces attack surface and unauthorised connectivity pathways on user endpoint devices. Annex A 8.1 is broader, covering protection of endpoint devices across many controls (e.g. configuration, hardening, and broader endpoint safeguards) beyond Bluetooth pairing hygiene.
This control partially overlaps A.5.18.
ISM-1199 requires Bluetooth pairings to be removed from relevant mobile devices once there is no longer a business requirement. This overlaps with Annex A 5.18 because a Bluetooth pairing effectively grants an external device an ongoing connection capability, which should be reviewed and removed when no longer authorised. Annex A 5.18 is about the full lifecycle of access rights for information assets generally, whereas ISM-1199 is a specific technical requirement focused on Bluetooth pairings on mobile devices.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.