ASD ISM 1298 Advise personnel on overseas mobile device security
What it says
Personnel are advised of privacy and security risks when travelling overseas with mobile devices.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishInform staff about privacy and security risks when taking mobile devices abroad.
Taking your mobile device overseas can expose it to privacy and security risks, such as data theft or hacking. This control is about ensuring staff understand these risks and know how to protect their devices and the information on them when they travel. If not managed properly, sensitive data could be stolen, leading to financial loss or damage to the organisation's reputation.
Free. Save your status, tasks and notes.
Why it matters
If staff are not advised, overseas travel with mobiles can cause compromise, data loss, fraud costs and reputational harm.
How to implement
HR should provide a training session for all staff members who travel overseas.
This training should cover potential security threats, ways devices can be hacked, and methods to protect them, like using strong passwords and avoiding public Wi-Fi networks.
IT teams need to prepare a 'travel kit' for mobile devices.
This could include installing security apps, configuring devices with remote wipe capability, and ensuring that encryption is enabled. They should also inform staff about using virtual private networks (VPNs) to secure connections.
Managers should remind their travelling staff to conduct pre-trip security checks on their mobile devices.
This involves updating the device software, backing up important data, and reviewing what sensitive information is stored on the device.
The organisation's security officer must develop clear policies for mobile usage abroad that align with guidance from the Australian Cyber Security Centre (ACSC).
This includes advising against connecting to unknown networks and guidelines for reporting lost or stolen devices.
Procurement teams should ensure that all company-issued mobile devices are purchased with robust built-in security features.
This serves as the first line of defence against potential breaches while these devices are abroad.
Keep it running
Brief travellers on overseas mobile risks: border searches, hostile Wi‑Fi/charging, local laws, and how to reduce data on devices.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Evidence of staff training sessions on mobile security.
Look at
Attendance records and the training material provided.
Good evidence
Shows comprehensive training that was attended by all relevant staff before overseas travel.
- Check 2 of 5What an auditor asks for
Look at
How these guidelines address security risks like public Wi-Fi and data encryption.
Good evidence
Will align guidelines with current ACSC recommendations.
- Check 3 of 5What an auditor asks for
Ask for
Records of pre-travel device checks.
Look at
Whether checks included software updates and data backups.
Good evidence
Shows a systematic approach with documented procedures followed before each trip.
- Check 4 of 5What an auditor asks for
Look at
How the inventory tracks security features and remote management capabilities.
Good evidence
Provides a detailed inventory, ensuring all devices have security features enabled.
- Check 5 of 5What an auditor asks for
Ask for
Incident reports for any lost or stolen devices while overseas.
Look at
The timelines of reporting and action taken.
Good evidence
Includes prompt reporting and follow-up actions to secure data.
Mappings
Closest match in ISO/IEC 27001: A.6.3, Information security awareness, education and training program, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.6.3.
ISM-1298 requires that personnel are advised of privacy and security risks when travelling overseas with mobile devices. ISO/IEC 27001:2022 Annex A 6.3 requires an organisation-wide awareness, education and training program with regular updates on relevant security policies and procedures. ISM-1298 fits as a specific, topic-focused awareness requirement (overseas mobile device risks) that would typically be delivered through the broader training and awareness framework mandated by Annex A 6.3.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.