ASD ISM 1300 Mobile device security after overseas travel
What it says
Upon returning from travelling overseas with mobile devices, personnel take the following actions: - sanitise and reset mobile devices, including all removable media - decommission any credentials that left their possession during their travel - report if significant doubt exists as to the integrity of any mobile devices or removable media.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUpon returning from overseas, clean your devices, reset any lost credentials, and report any security concerns.
When you come back from a trip overseas with your phone, tablet, or any other device, it's crucial to clean them up and ensure they are secure. This matters because while travelling, your devices are more exposed to risks like hacking or theft, and this could lead to someone accessing your private information or business data.
Free. Save your status, tasks and notes.
Why it matters
If devices and removable media aren't reset after overseas travel, malware may persist, enabling data compromise and unauthorised access.
How to implement
IT staff should sanitise devices upon return from overseas.
This involves wiping and reinstalling the device's operating system and applications to ensure any potentially harmful software picked up during travel is removed.
Managers must ensure employees report lost or stolen devices immediately.
They should create an easy procedure for reporting, which could be a simple form or a quick call to the IT team.
HR should organise training sessions on the importance of resetting passwords for any accounts accessed on the device during travel.
They can provide a checklist of accounts to consider such as email, social media, and work-related apps.
IT staff must check removable media such as USB sticks used during travel by scanning them with antivirus software before reconnecting to office systems to ensure they are free of malware.
System owners should work with IT to review and decommission any credentials that might have been compromised during travel.
This might include changing passwords and revoking access tokens or certificates.
Keep it running
After overseas travel, wipe/sanitise and reset mobiles and removable media, revoke any credentials that left your possession, and report integrity concerns.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Travel procedures documentation.
Look at
Whether it includes steps for sanitising and resetting devices after travel.
Good evidence
Is a document with a clearly outlined process for post-travel device hygiene.
- Check 2 of 5What an auditor asks for
Good evidence
Includes training attendance records and session materials showing these topics were covered.
- Check 3 of 5What an auditor asks for
Ask for
A log of reported lost or stolen devices.
Look at
Whether incidents are recorded promptly and actions taken as per the procedure.
Good evidence
Will show a recent loss or theft was reported and handled appropriately.
- Check 4 of 5What an auditor asks for
Look at
Reports showing media scanned and results recorded.
Good evidence
Is a log showing recent scans, date, and outcome for media used abroad.
- Check 5 of 5What an auditor asks for
Ask for
System audit logs showing credential changes after travel.
Look at
Entries indicating passwords or access rights were adjusted.
Good evidence
Includes a documented trail of credential updates.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.7.10.
ISM-1300 requires that after overseas travel, mobile devices and any removable media are sanitised and reset, and any credentials that left the user's possession are decommissioned, with escalation when integrity is in doubt. Annex A 7.10 covers secure management of storage media across its lifecycle, including transportation and disposal, which aligns with the need to control and handle removable media taken overseas and to apply secure disposal/sanitisation on return. Annex A 7.10 does not address mobile device re-imaging or credential decommissioning, while ISM-1300 is a travel-return remediation control rather than a full media lifecycle management requirement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.