ASD ISM 1482 Ensure separation of classified and personal data on devices
What it says
Personnel using organisation-owned mobile devices or desktop computers to access classified systems or data have enforced separation of classified data and personal data.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOrganisation devices must keep classified and personal data separate to protect classified information.
Keeping classified and personal data separate on work devices ensures that sensitive information stays protected. Without this separation, there's a risk that confidential data could be accidentally shared or lost, leading to security breaches or legal issues.
Free. Save your status, tasks and notes.
Why it matters
Without proper separation, classified data may end up in personal apps, risking leaks, breaches, and potential legal issues.
How to implement
The IT team should set up separate user profiles on organisation-owned devices.
They can create one profile for work tasks and another for personal use by employees. This helps ensure that work data remains separate from personal data.
Managers should inform all employees about the importance of separating work and personal data.
They can do this by organising a short training session where they explain the potential risks of not following this policy.
System administrators should configure devices to restrict access to work-related applications and data from personal user profiles.
They can use software settings to ensure that only work profiles can open work apps and files.
HR should include information about data separation practices in the employee onboarding process.
New employees could receive a guide that outlines how to properly manage work and personal data on their company devices.
Procurement staff should choose devices that support multiple user profiles.
When purchasing new equipment, they should check that devices allow easy management of separate accounts for different uses.
Keep it running
Regularly review and update account settings to ensure that data remains strictly separated as technologies and policies evolve.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The device policy document: Request a copy of the policy that explains data separation requirements for organisation-owned devices.
Look at
How the policy describes keeping work and personal data separate.
Good evidence
Is a clear section detailing the requirement for separate profiles or accounts.
- Check 2 of 5What an auditor asks for
Ask for
Device configuration reports: Request a sample report from the IT team showing how devices are set up.
Look at
The configuration settings to see if they enforce data separation through profiles or access controls.
Good evidence
Includes settings that enforce these separations.
- Check 3 of 5What an auditor asks for
Ask for
Employees about their understanding: Interview a few employees to see if they understand how to keep their work and personal data separate.
Look at
Their responses for knowledge of data separation practices.
Good evidence
Is employees confidently describing how they use separate profiles.
- Check 4 of 5What an auditor asks for
Ask for
Training materials: Request any documents or presentations used for teaching employees about data separation.
Look at
Whether the materials clearly explain why and how to separate work and personal data.
Good evidence
Includes comprehensive materials with examples.
- Check 5 of 5What an auditor asks for
Ask for
Records of device checks: Request logs or records showing routine checks of devices for data separation compliance.
Look at
How frequently these checks occur and the results.
Good evidence
Shows regular checks with documented outcomes proving compliance.
Mappings
Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.8.1.
ISM-1482 requires enforced separation of classified data from personal data on organisation-owned mobile devices and desktop computers. Annex A 8.1 requires protection of information stored on, processed by, or accessible via endpoint devices, which can include controls like containerisation, separate user profiles, and managed storage that enable such separation. Annex A 8.1 is broader because it covers endpoint protection generally (e.g. hardening, encryption, patching, configuration), not specifically the classified-versus-personal segregation requirement.
This control partially meets A.8.12.
ISM-1482 requires enforced separation of classified data from personal data on organisation-owned devices. Annex A 8.12 requires data leakage prevention measures across systems and devices, which supports ISM-1482 by reducing the risk of classified data being copied into personal apps, accounts, or storage locations. However, DLP can operate without true separation (it can monitor/block flows), so it is complementary rather than the same requirement.
This control partially overlaps A.6.7.
ISM-1482 requires enforced on-device separation of classified data and personal data for organisation-owned mobiles and desktops used to access classified systems or data. Annex A 6.7 requires security measures for remote working to protect information accessed, processed or stored outside organisational premises, and those measures can include managed containers/profiles, separate work/personal spaces, and restrictions on personal app access that incidentally achieve segregation. The connection is indirect: Annex A 6.7 does not specifically mandate classified-versus-personal separation, and ISM-1482 applies regardless of whether the user is remote, so each control has scope the other does not cover.
This control supports A.5.12.
ISM-1482 requires enforced separation of classified data from personal data on organisation-owned devices, which presumes the organisation can identify what is 'classified' and what is 'personal'. Annex A 5.12 establishes information classification policy and practices, providing the prerequisite labelling/handling rules needed to decide what data must be segregated to meet ISM-1482. Without classification practices, implementing and auditing the separation required by ISM-1482 is materially undermined.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.