What does ASD ISM 1554 require?

policyASD Information Security Manual (ISM)

ASD ISM 1554Guidelines for Using Mobile Devices Abroad

Official control statement

If travelling overseas with mobile devices to high or extreme risk countries, personnel are: - issued with newly provisioned user accounts, mobile devices and removable media from a pool of dedicated travel devices which are used solely for work-related activities - advised on how to apply and inspect tamper seals to key areas of mobile devices - advised to avoid taking any personal mobile devices, especially if rooted or jailbroken.

policyASD Information Security Manual (ISM)ISM-1554

Quoted as published. Everything else on this page is written by Control Stack.

In plain English

Use specific work devices and avoid personal phones when going to high-risk countries.

NC OS PASD Information Security ManualGuidelines for enterprise mobility

Control Stack classificationPreventative Mobile devices Remote working and off-site assets

record_voice_over

What this means in practice

When travelling to countries with high security risks, it's essential to use work-specific devices and accounts. This is because personal devices can be vulnerable to hacking or surveillance in these areas, which might expose sensitive work data.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect (Control Stack)

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

Dec 2024

Control Stack last updated

29 Sept 2026

E8 maturity levels

N/A

Guideline

Guidelines for enterprise mobility

Section

Mobile device usage

Topic

Before travelling overseas with mobile devices

priority_high

Why it matters

Without dedicated travel devices and accounts, overseas travel to high-risk countries can expose sensitive data to surveillance or theft.

settings

Operational notes

Issue dedicated travel devices/accounts for high-risk trips, apply tamper seals, inspect on return, then wipe and decommission devices/media.

02 - Implement

build

Implementation tips

IT team should provision dedicated travel devices: They should prepare smartphones or tablets specifically for work trips, ensuring they only contain necessary applications and data. This can be done by maintaining a pool of clean devices that are reset and reconfigured before each trip.
Security manager should educate travellers on device usage: Organise a briefing session where employees learn about using tamper seals on their travel devices. Explain how to apply these seals over sensitive areas like USB ports and camera lenses to detect unauthorised access.
HR should coordinate the distribution of these devices: Ensure that employees going on international trips are given these specific devices rather than using personal ones. Create a checklist for signing devices in and out to maintain control and responsibility.
IT team should disable unnecessary features on travel devices: Before provisioning, IT should remove or disable non-essential applications or features that might present security vulnerabilities. This might include disabling automatic connections to Wi-Fi or Bluetooth to avoid unintentional data sharing.
Employees are advised not to take personal mobile devices: Communicate the risks of using personal devices, particularly those that are rooted or have altered security settings, as these are more susceptible to attacks. Provide simple instructions on how to check if a device is rooted or jailbroken.

03 - Audit

fact_check

Audit / evidence tips

AskA list of travel devices: Request documentation showing the inventory of devices dedicated for travel useLook atHow these devices are logged and maintainedGoodIs a current list showing assigned employees, device statuses, and setup dates
AskThe tamper seal education material: Request copies of presentation slides or handouts used to educate employees on using tamper sealsLook atThe comprehensiveness of instructions providedGoodSign is clear, concise steps explaining tamper seal application and check procedures
AskTravel device distribution logs: Check the records of who has been issued specific devices for travelLook atCompleteness and regular updatesGoodShows devices are tracked in a log file with check-out and check-in dates, and employees' signatures
AskA protocol on feature disabling: Request documentation on the procedures for disabling unnecessary features on travel devicesLook atThe specific steps and accountability outlinedGoodIs a detailed guide listing precise features disabled for safety during travel
AskEmployee advisories: Request email communications or memos advising employees against bringing personal devices, especially rooted onesLook atClarity and specificity in the advisory contentGoodIncludes warnings about risks and facts on rooting vulnerabilities

04 - Mappings

link

Cross-framework mappings

How ISM-1554 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
open_in_fullBroader than(2)expand_less
Annex A 7.9	ISM-1554 addresses protecting mobile devices used off-site during overseas travel to high or extreme risk countries by mandating dedicate...
Annex A 8.1	ISM-1554 requires heightened protection for user endpoint devices during overseas travel to high or extreme risk countries by using newly...
layersPartially meets(1)expand_less
Annex A 6.7	ISM-1554 requires specific precautions for personnel travelling overseas with mobile devices to high or extreme risk countries, including...
sync_altPartially overlaps(1)expand_less
Annex A 6.3	ISM-1554 requires personnel travelling to high or extreme risk countries to follow specific behaviours (use dedicated work devices/accoun...