ASD ISM 1200 Secure Bluetooth pairing for mobile devices
What it says
Bluetooth pairing for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices is performed using Secure Connections, preferably with Numeric Comparison if supported.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse secure methods when pairing Bluetooth on sensitive mobile devices, like numeric comparison.
When pairing a mobile device with Bluetooth, especially if the device stores sensitive information, it's important to use secure methods like checking a number on both devices. This protects your information from being intercepted by others, which could lead to data breaches or unauthorised access to your device.
Free. Save your status, tasks and notes.
Why it matters
Without Secure Connections Bluetooth pairing (preferably Numeric Comparison), nearby attackers may intercept traffic or spoof devices, exposing OFFICIAL: Sensitive/PROTECTED data.
How to implement
The IT manager should ensure all staff are trained on secure Bluetooth pairing.
They can do this by organising a workshop where staff can learn how to compare numbers displayed on devices during the pairing process.
Mobile device users should always double-check that they are pairing with the correct device.
This can be achieved by confirming the name of the device they are trying to connect to and ensuring it matches the one displayed on their screen.
The cyber security team should enable Bluetooth Secure Connections on all devices that support it.
This involves going into device settings and choosing the option for secure pairing, which often includes a numeric comparison feature.
Procurement officers should prioritise purchasing devices that support secure Bluetooth pairing methods such as Numeric Comparison.
This includes checking product specifications to ensure these features are available before purchasing.
Managers should establish a policy that mandates secure pairing methods for devices handling sensitive information.
This involves writing a simple policy document and distributing it to all staff members, describing the steps for secure pairing.
Keep it running
Configure devices to require Secure Connections pairing and use Numeric Comparison where supported; periodically test pairing prompts and remove/deny unknown or legacy pairings.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The training records for staff on Bluetooth security procedures. Look to see if the records show the training included secure pairing techniques, specifically numeric comparison.
Good evidence
: training records showing all staff attended and understood the secure pairing method.
- Check 2 of 5What an auditor asks for
Look at
The specifications to see if they support Bluetooth Secure Connections with Numeric Comparison. Good criteria: all recent purchases should support secure pairing methods.
- Check 3 of 5What an auditor asks for
Ask for
The current mobile device policy document. Check that it includes instructions for secure pairing, specifically the use of Numeric Comparison.
Good evidence
A policy document that clearly states numeric comparison as the standard for Bluetooth pairing.
- Check 4 of 5What an auditor asks for
Good evidence
Outcome: logs indicating that numeric comparison was used for every pairing.
- Check 5 of 5What an auditor asks for
Ask for
A report on how secure Bluetooth features are being configured on devices.
Look at
The report to ensure Bluetooth Secure Connections are enabled. Good results: a report showing that all devices have secure pairing configurations turned on.
Mappings
Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.1.
Annex A 8.1 requires protecting information accessible via endpoint devices, including reducing the risk of unauthorised access through local wireless interfaces. ISM-1200 mandates secure Bluetooth pairing methods for specified mobile devices, reducing the likelihood of interception or unauthorised pairing that could expose data or device access. ISM-1200 is a narrow technical requirement for a specific interface and does not cover the broader endpoint protection obligations of Annex A 8.1.
This control partially overlaps A.8.5.
ISM-1200 requires Bluetooth pairing on sensitive mobile devices to use Secure Connections and preferably Numeric Comparison to ensure the pairing process resists unauthorised access. This overlaps with ISO/IEC 27001:2022 Annex A 8.5 because Bluetooth pairing is an authentication/verification process between devices and relies on secure authentication procedures. Annex A 8.5 is broader across all authentication technologies and access contexts, whereas ISM-1200 is specific to Bluetooth pairing on mobile devices at OFFICIAL: Sensitive and PROTECTED.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.