ASD ISM 1299 Personnel awareness for secure mobile device usage
What it says
Personnel are advised to take the following precautions when using mobile devices: - never leave mobile devices or removable media unattended, including by placing them in checked-in luggage or leaving them in hotel safes - never store credentials with mobile devices that they grant access to, such as in laptop computer bags - never lend mobile devices or removable media to untrusted people, even if briefly - never allow untrusted people to connect their mobile devices or removable media to your mobile devices, including for charging - never connect mobile devices to designated charging stations or wall outlet charging ports - never use gifted or unauthorised peripherals, chargers or removable media with mobile devices - never use removable media for data transfers or backups that have not been checked for malicious code beforehand - avoid reuse of removable media once used with other parties' systems or mobile devices - avoid connecting mobile devices to open or untrusted Wi-Fi networks - consider disabling any communications capabilities of mobile devices when not in use, such as Wi-Fi, Bluetooth, Near Field Communication and ultra-wideband - consider periodically rebooting mobile devices - consider using a VPN connection to encrypt all cellular and wireless communications - consider using encrypted email or messaging apps for all communications.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThis guideline advises on secure mobile device use to prevent data theft or compromise.
These guidelines are about using your phone and other mobile devices safely to protect important data. If you don't follow them, you could accidentally let someone steal sensitive information or even allow harmful software onto your device, which can lead to major problems like identity theft or financial loss.
Free. Save your status, tasks and notes.
Why it matters
If personnel ignore safe mobile practices (untrusted charging, Wi‑Fi, peripherals or media), devices can be compromised, causing data theft and incidents.
How to implement
Managers should ensure that all staff are aware of the importance of not leaving mobile devices unattended.
They can do this by organising a meeting or sending an email that highlights the risks of theft or unauthorised access if devices are left in places like hotel safes or checked-in luggage.
IT teams should set up a policy that prevents staff from storing passwords or login details together with their mobile devices.
This can be implemented through training sessions that demonstrate safe storage practices, such as using password managers.
Human Resources departments should provide training sessions to teach employees about the dangers of lending their mobile devices or media to untrusted people, even if only for a short time.
These sessions can include examples of real-world consequences and ways to politely refuse if asked.
Security teams should advise employees never to connect their mobile devices to unknown charging stations or use cables given by people they don't trust.
During staff briefings, show how to recognise legitimate vs. suspicious charging set-ups and recommend carrying a personal charger.
Staff in charge of purchasing should ensure that only authorised peripherals and removable media are used with company devices.
They can do this by maintaining an approved list of equipment and conducting regular checks to ensure compliance.
Keep it running
Reinforce do's/don'ts: don't leave devices unattended, avoid open Wi‑Fi, block unknown charging/media, and remind staff to disable radios and use VPN/encrypted apps.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
A record of security training sessions provided to staff about mobile device usage.
Look at
The attendance list and the content covered. Good evidence would be comprehensive training materials and signed attendance sheets.
- Check 2 of 4What an auditor asks for
Look at
How it instructs staff to secure devices in different environments.
Good evidence
Document will have clear guidelines and examples.
- Check 3 of 4What an auditor asks for
Ask for
Documented procedures on how staff should store credentials separately from devices. Review the process steps and security arrangements recommended. A well-written document will explain safe practices and offer solutions like password managers.
- Check 4 of 4What an auditor asks for
Ask for
To see the checklist used when authorising new peripherals or cables for use with company devices.
Look at
Documented approvals and checks performed.
Good evidence
Checklist will document tested and approved items, avoiding any unauthorised use.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.7.10.
ISM-1299 instructs personnel to handle mobile devices and removable media securely (e.g. do not leave unattended, do not lend to untrusted people, avoid reusing removable media used with other parties, and scan media for malicious code). This supports ISO/IEC 27001:2022 Annex A 7.10 by providing concrete user-facing practices for safe use and transportation of storage media within its lifecycle. Annex A 7.10 is broader and process-oriented (acquisition through disposal) across all media types, whereas ISM-1299 focuses on day-to-day end-user precautions for mobile devices and associated removable media.
This control partially overlaps A.8.7.
ISM-1299 provides user precautions that reduce malware introduction on mobile devices, such as not using gifted/unauthorised peripherals, not connecting to public charging ports, and scanning removable media before use. This supports ISO/IEC 27001:2022 Annex A 8.7 by contributing to the 'appropriate user awareness' component of malware protection and reducing common infection vectors. Annex A 8.7 also requires technical malware controls, whereas ISM-1299 is primarily personnel awareness and behaviour for mobile devices and removable media.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.