ASD ISM 1554 Guidelines for using mobile devices abroad
What it says
If travelling overseas with mobile devices to high or extreme risk countries, personnel are: - issued with newly provisioned user accounts, mobile devices and removable media from a pool of dedicated travel devices which are used solely for work-related activities - advised on how to apply and inspect tamper seals to key areas of mobile devices - advised to avoid taking any personal mobile devices, especially if rooted or jailbroken.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse specific work devices and avoid personal phones when going to high-risk countries.
When travelling to countries with high security risks, it's essential to use work-specific devices and accounts. This is because personal devices can be vulnerable to hacking or surveillance in these areas, which might expose sensitive work data.
Free. Save your status, tasks and notes.
Why it matters
Without dedicated travel devices and accounts, overseas travel to high-risk countries can expose sensitive data to surveillance or theft.
How to implement
IT team should provision dedicated travel devices: They should prepare smartphones or tablets specifically for work trips, ensuring they only contain necessary applications and data.
This can be done by maintaining a pool of clean devices that are reset and reconfigured before each trip.
Security manager should educate travellers on device usage: Organise a briefing session where employees learn about using tamper seals on their travel devices.
Explain how to apply these seals over sensitive areas like USB ports and camera lenses to detect unauthorised access.
HR should coordinate the distribution of these devices: Ensure that employees going on international trips are given these specific devices rather than using personal ones.
Create a checklist for signing devices in and out to maintain control and responsibility.
IT team should disable unnecessary features on travel devices: Before provisioning, IT should remove or disable non-essential applications or features that might present security vulnerabilities.
This might include disabling automatic connections to Wi-Fi or Bluetooth to avoid unintentional data sharing.
Employees are advised not to take personal mobile devices: Communicate the risks of using personal devices, particularly those that are rooted or have altered security settings, as these are more susceptible to attacks.
Provide simple instructions on how to check if a device is rooted or jailbroken.
Keep it running
Issue dedicated travel devices/accounts for high-risk trips, apply tamper seals, inspect on return, then wipe and decommission devices/media.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of travel devices: Request documentation showing the inventory of devices dedicated for travel use.
Look at
How these devices are logged and maintained.
Good evidence
Is a current list showing assigned employees, device statuses, and setup dates.
- Check 2 of 5What an auditor asks for
Ask for
The tamper seal education material: Request copies of presentation slides or handouts used to educate employees on using tamper seals.
Look at
The comprehensiveness of instructions provided.
Good evidence
Sign is clear, concise steps explaining tamper seal application and check procedures.
- Check 3 of 5What an auditor asks for
Ask for
Travel device distribution logs: Check the records of who has been issued specific devices for travel.
Look at
Completeness and regular updates.
Good evidence
Shows devices are tracked in a log file with check-out and check-in dates, and employees' signatures.
- Check 4 of 5What an auditor asks for
Ask for
A protocol on feature disabling: Request documentation on the procedures for disabling unnecessary features on travel devices.
Look at
The specific steps and accountability outlined.
Good evidence
Is a detailed guide listing precise features disabled for safety during travel.
- Check 5 of 5What an auditor asks for
Ask for
Employee advisories: Request email communications or memos advising employees against bringing personal devices, especially rooted ones.
Look at
Clarity and specificity in the advisory content.
Good evidence
Includes warnings about risks and facts on rooting vulnerabilities.
Mappings
Closest match in ISO/IEC 27001: A.7.9, Security of off-site assets, which this control covers in full and more.
ISO/IEC 27001: 4 mappings
This control is broader than A.7.9.
ISM-1554 addresses protecting mobile devices used off-site during overseas travel to high or extreme risk countries by mandating dedicated work-only travel devices/accounts and physical tamper-evidence checks. Annex A 7.9 requires that off-site assets are protected, which includes endpoint devices taken off premises. ISM-1554 is narrower because it focuses on a specific high-risk travel scenario and prescribes particular measures (dedicated travel pool and tamper seals) not required by Annex A 7.9.
This control is broader than A.8.1.
ISM-1554 requires heightened protection for user endpoint devices during overseas travel to high or extreme risk countries by using newly provisioned accounts and dedicated work-only travel devices and applying tamper seals. Annex A 8.1 requires organisations to protect information stored on, processed by, or accessible via user endpoint devices in general. ISM-1554 is a specific, high-risk travel subset of endpoint protection, adding travel-specific operational measures (e.g. tamper-evidence inspection and avoiding personal rooted/jailbroken phones) beyond the generic endpoint requirement.
This control partially meets A.6.7.
ISM-1554 requires specific precautions for personnel travelling overseas with mobile devices to high or extreme risk countries, including using dedicated travel devices and accounts and applying tamper seals. Annex A 6.7 requires security measures for remote working to protect information accessed, processed or stored outside organisational premises, which can include travel and mobile use scenarios. ISM-1554 is a concrete, travel-to-high-risk-countries implementation pattern, while Annex A 6.7 is broader and technology-agnostic for all remote working contexts.
This control partially overlaps A.6.3.
ISM-1554 requires personnel travelling to high or extreme risk countries to follow specific behaviours (use dedicated work devices/accounts, apply and inspect tamper seals, and avoid personal rooted/jailbroken devices). Annex A 6.3 requires an information security awareness, education and training program to ensure personnel understand and follow required security practices. Annex A 6.3 supports ISM-1554 by providing the mechanism to train travellers on tamper seals and safe device handling, but it does not itself mandate the travel-device provisioning controls.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.