ASD ISM 1556 Security measures after overseas travel with mobile devices
What it says
If returning from travelling overseas with mobile devices to high or extreme risk countries, personnel take the following additional actions: - reset credentials used with mobile devices, including those used for remote access to their organisation's systems - monitor user accounts for any indicators of compromise, such as failed logon attempts.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishReset credentials and watch for suspicious account activity after travel to high-risk areas.
When you travel overseas, especially to countries where cyber security risks are high, you might unknowingly expose your devices and accounts to threats. Upon returning, it's important to change your passwords and keep an eye on your accounts for any unusual activity. This helps prevent hackers from using your information to access your organisation's systems or personal data, protecting both your business and personal life from potential harm.
Free. Save your status, tasks and notes.
Why it matters
If credentials aren't reset after travel to high/extreme-risk countries, attackers may reuse them for remote access and compromise accounts.
How to implement
IT team should organise a post-travel security session for returning employees.
Schedule a quick briefing to explain the importance of resetting passwords and monitoring accounts for suspicious activity. Provide a step-by-step guide on how to reset passwords securely and what signs of account compromise look like.
Managers should ensure employees have access to resources for secure password management.
Offer tools or password manager software that help personnel reset and store their passwords safely. Provide training on creating strong, unique passwords that are not easily guessed.
HR should update travel policies to include post-travel cyber security steps.
Add a checklist to travel documents outlining that employees should reset their passwords and monitor account logins upon return, emphasising how this protects not just one person but the entire organisation.
Security officers should facilitate automated alerts for account monitoring.
Work with the IT team to set up alerts that notify both employees and security personnel of unusual login attempts on organisational accounts. Use simple email or SMS alerts so that non-technical staff can easily understand and act on them.
The IT team should review and update remote access systems regularly.
Evaluate the existing security measures in place for accessing organisational systems remotely. Ensure that all employees are aware of and can access the most secure, up-to-date practices for logging in, especially after returning from high-risk countries.
Keep it running
After returning from high/extreme-risk travel, reset all mobile/remote-access credentials and monitor accounts for failed logons or other compromise signs.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of recent overseas travellers within the organisation.
Look at
Whether these personnel have reset their credentials upon their return.
Good evidence
Would be a record showing that all returning travellers have updated their passwords and followed the necessary security procedures.
- Check 2 of 5What an auditor asks for
Good evidence
Includes detailed reports of notification alerts and documented responses that show issues were addressed promptly.
- Check 3 of 5What an auditor asks for
Ask for
To see written post-travel security briefings. Check these briefings for clear instructions on password resets and account monitoring.
Good evidence
Should have easily understandable instructions with any necessary contact information for support if issues arise.
- Check 4 of 5What an auditor asks for
Look at
Deployment logs and usage statistics.
Good evidence
Includes documentation of the tools being offered to all applicable personnel and indicates active use of these tools.
- Check 5 of 5What an auditor asks for
Ask for
Records of IT system updates related to remote access since the last overseas travel period. Check whether updates have been applied and whether staff have been notified of the changes.
Good evidence
Includes a changelog of updates and confirmation emails sent to staff indicating these updates.
Mappings
Closest match in ISO/IEC 27001: A.8.16, Monitoring networks and systems for anomalous behaviour, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.8.16.
ISM-1556 requires personnel returning from high-risk overseas travel with mobile devices to reset credentials and monitor user accounts for compromise. Annex A 8.16 involves monitoring networks, systems and applications for suspicious behaviour, supporting ISM-1556's goal to identify suspicious activity. Annex A 8.16 is broader, covering general monitoring, while ISM-1556 focuses on post-travel actions.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.