ASD ISM 1555 Prepare mobile devices before overseas travel
What it says
Before travelling overseas with mobile devices, personnel take the following actions: - record all details of the mobile devices being taken, such as product types, serial numbers and International Mobile Equipment Identity numbers - update all operating systems and applications - remove all non-essential data, applications and user accounts - backup all remaining data, applications and settings.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishBefore travelling overseas, ensure mobile devices are recorded, updated, reduced to essentials, and backed up to safeguard data.
Before you travel overseas, it's important to prepare your mobile devices to protect the information on them. This preparation involves recording key details about your devices, updating them, only keeping necessary data, and backing up everything important. If you skip these steps, you risk losing valuable data or having it compromised, which can be inconvenient and damaging to your personal or business security.
Free. Save your status, tasks and notes.
Why it matters
If devices aren't inventoried, patched, stripped of non-essential data and backed up before overseas travel, theft or compromise can expose sensitive data and hinder recovery.
How to implement
The IT team or individuals should record device details: Make a list of all the mobile devices you are taking, including their product types, serial numbers, and International Mobile Equipment Identity (IMEI) numbers.
You can usually find this information on the device itself or in its settings menu.
The IT team should ensure that all mobile devices are updated: Check that the operating systems and all apps on your devices are updated to their latest versions.
This usually involves going to the settings on your device and selecting 'update' or allowing automatic updates to ensure you have the latest security patches.
The user should remove non-essential data and apps: Go through your devices and delete any apps or data you won't need while travelling.
This can help protect your information by limiting exposure if your device is lost or stolen. Be sure to remove old accounts that are no longer in use.
The IT team or users should perform a backup of devices: Use cloud services or an external hard drive to back up all important data, apps, and settings.
Most smartphones have a built-in option to create backups, which can be found in the phone's settings.
Managers should have a checklist for employees' device preparation: Create a checklist to ensure all steps are followed before anyone travels.
This checklist should include recording device details, updating systems, removing unnecessary items, and performing backups, making sure to check off each step before travelling.
Keep it running
Keep a pre-travel checklist: record make/model, serial and IMEI; apply OS/app updates; remove non-essential apps/accounts/data; then back up remaining data and settings.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The recorded list of mobile devices: Request to see the document or file where device details including product types, serial numbers, and IMEI numbers are stored.
Look at
Whether all items being travelled with are listed and details are complete.
Good evidence
Shows a comprehensive, up-to-date list.
- Check 2 of 5What an auditor asks for
Ask for
The update log of devices: Request evidence that all devices have been updated, such as system logs or status reports.
Look at
The date and version numbers to confirm they are current. Good evidence shows recent updates with no pending items.
- Check 3 of 5What an auditor asks for
Ask for
A list of deleted apps and data: Request documentation or a checklist showing what non-essential data or apps have been removed from the devices. Look whether unnecessary apps and user accounts were indeed removed. Good evidence contains a list with corresponding actions and dates.
- Check 4 of 5What an auditor asks for
Ask for
Backup verification: Request proof that all the data was backed up before travel, like a screenshot of the backup settings or confirmation email. Look to see if backups cover all data, apps, and settings.
Good evidence
Would include backup details, dates, and a quick way to restore data if needed.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of the pre-travel checklist: Request to see the filled-out checklist used for ensuring devices were properly set up before travel. Look to see if each step was checked off with a person's initials and date.
Good evidence
Has a signed and dated checklist with all items verified as completed.
Mappings
Closest match in ISO/IEC 27001: A.8.13, Backup and recovery procedures for data, which this control covers in full and more.
ISO/IEC 27001: 1 mapping
This control is broader than A.8.13.
ISM-1555 requires personnel to back up remaining data, applications, and settings before taking mobile devices overseas, as part of a broader pre-travel hardening process. Annex A 8.13 relates by requiring backup copies to be maintained and regularly tested in accordance with an agreed backup policy, which encompasses the act of performing backups that ISM-1555 calls for. ISM-1555 is narrower because it is travel-triggered and device-specific, whereas Annex A 8.13 covers ongoing backup governance and testing across systems.
ASD Essential Eight: 3 mappings
This control is broader than E8-RB-ML1.1.
ISM-1555 requires personnel to prepare mobile devices for overseas travel by recording device details, updating software, removing non-essential data/accounts, and backing up what remains. E8-RB-ML1.1 relates by setting an organisational requirement that backups of data, applications, and settings are performed and retained based on business criticality and continuity needs, which is one of the explicit actions in ISM-1555. ISM-1555 is narrower because it is travel-specific, while E8-RB-ML1.1 defines backup alignment and retention expectations across the organisation.
This control is broader than E8-RB-ML1.2.
ISM-1555 requires mobile devices to be backed up prior to overseas travel alongside updating and data minimisation steps. E8-RB-ML1.2 relates by specifying a quality attribute of backups (synchronised to a common point in time) that strengthens the usefulness of the pre-travel backup required by ISM-1555. ISM-1555 does not require point-in-time synchronisation, so it is a narrower, event-based backup requirement compared with the broader backup consistency requirement in E8-RB-ML1.2.
This control is broader than E8-RB-ML1.4.
ISM-1555 requires creating a backup of mobile device data/applications/settings prior to overseas travel to reduce impact if the device is lost, seized, or compromised. E8-RB-ML1.4 relates by requiring testing of restoration from backups to a common point in time during disaster recovery exercises, which ensures the backups ISM-1555 relies on are actually recoverable. ISM-1555 is narrower because it does not require restoration testing or DR exercising, only that a backup be taken before travel.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.