ISM-1482 policy ASD Information Security Manual (ISM)

Ensure Separation of Classified and Personal Data on Devices

Organisation devices must keep classified and personal data separate to protect classified information.

Preventative OS P S ASD Information Security ManualGuidelines for communications systems devices environment separation March 2026 ISM Update

record_voice_over

Plain language

Keeping classified and personal data separate on work devices ensures that sensitive information stays protected. Without this separation, there's a risk that confidential data could be accidentally shared or lost, leading to security breaches or legal issues.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Preventative

Classifications

OS, P, S, TS

ISM last updated

Mar 2026

Control Stack last updated

18 May 2026

E8 maturity levels

N/A

Guideline

Guidelines for communications systems

Section

Enterprise mobility

Topic

Organisation-owned mobile devices and desktop computers

Official control statement

Personnel using organisation-owned mobile devices or desktop computers to access classified systems or data have enforced separation of classified data and personal data.

policy ASD Information Security Manual (ISM) ISM-1482

priority_high

Why it matters

Without proper separation, classified data may end up in personal apps, risking leaks, breaches, and potential legal issues.

settings

Operational notes

Regularly review and update account settings to ensure that data remains strictly separated as technologies and policies evolve.

02 - Implement

build

Implementation tips

The IT team should set up separate user profiles on organisation-owned devices. They can create one profile for work tasks and another for personal use by employees. This helps ensure that work data remains separate from personal data.
Managers should inform all employees about the importance of separating work and personal data. They can do this by organising a short training session where they explain the potential risks of not following this policy.
System administrators should configure devices to restrict access to work-related applications and data from personal user profiles. They can use software settings to ensure that only work profiles can open work apps and files.
HR should include information about data separation practices in the employee onboarding process. New employees could receive a guide that outlines how to properly manage work and personal data on their company devices.
Procurement staff should choose devices that support multiple user profiles. When purchasing new equipment, they should check that devices allow easy management of separate accounts for different uses.

03 - Audit

fact_check

Audit / evidence tips

AskThe device policy document: Request a copy of the policy that explains data separation requirements for organisation-owned devices GoodIs a clear section detailing the requirement for separate profiles or accounts
AskDevice configuration reports: Request a sample report from the IT team showing how devices are set up GoodIncludes settings that enforce these separations
AskEmployees about their understanding: Interview a few employees to see if they understand how to keep their work and personal data separate GoodIs employees confidently describing how they use separate profiles
AskTraining materials: Request any documents or presentations used for teaching employees about data separation GoodIncludes comprehensive materials with examples
AskRecords of device checks: Request logs or records showing routine checks of devices for data separation compliance GoodShows regular checks with documented outcomes proving compliance

04 - Mappings

link

Cross-framework mappings

How ISM-1482 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
layers Partially meets (1) expand_less
Annex A 8.1	ISM-1482 requires enforced separation of classified data from personal data on organisation-owned mobile devices and desktop computers
sync_alt Partially overlaps (1) expand_less
Annex A 6.7	ISM-1482 requires enforced on-device separation of classified data and personal data for organisation-owned mobiles and desktops used to ...
handshake Supports (1) expand_less
Annex A 8.12	ISM-1482 requires enforced separation of classified data from personal data on organisation-owned devices
extension Depends on (1) expand_less
Annex A 5.12	ISM-1482 requires enforced separation of classified data from personal data on organisation-owned devices, which presumes the organisatio...

These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.