ASD ISM 1644 Secure communication practices in public areas
What it says
Sensitive or classified phone calls and conversations are not conducted in public locations unless care is taken to reduce the chance of conversations being overheard.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAvoid discussing sensitive topics on mobile phones in public to prevent eavesdropping.
This control is about making sure you don't discuss private or sensitive matters on your mobile phone when you're in public. Imagine you're at a café, talking about a business deal or a confidential client issue. If someone overhears, you could risk exposing important information, which could lead to financial loss or damage to your organisation's reputation.
Free. Save your status, tasks and notes.
Why it matters
Sensitive phone calls in public can be overheard, causing unauthorised disclosure of information and potential financial and reputational harm.
How to implement
Managers should educate employees about the risks of discussing sensitive topics in public.
Conduct regular training sessions where you explain why it's important to avoid sensitive conversations in places like coffee shops or on public transport.
Team leaders should establish guidelines for what not to discuss in public places.
Provide a checklist or quick-reference guide of topics that should always be covered in private, ensuring team members know what constitutes sensitive information.
IT personnel could implement technical solutions to help mitigate risks.
For instance, suggest using secure messaging apps with strong encryption for sensitive communications, especially when employees are away from the office.
HR departments should incorporate this control into the organisation's official policies.
Include clear language in the employee handbook about maintaining confidentiality and the proper channels for handling sensitive discussions.
Business owners should lead by example to foster a culture of awareness around secure communication.
Share personal anecdotes or examples of potential risks during team meetings to make the policy relatable and memorable.
Keep it running
Avoid sensitive calls in public. If unavoidable, move to a private area, speak quietly, and use approved encrypted calling/messaging where available.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The training records: Request documentation of any training sessions conducted regarding secure communication practices.
Look at
The attendee list and the training content.
Good evidence
Includes a regular schedule of sessions with comprehensive coverage of risks and guidelines.
- Check 2 of 5What an auditor asks for
Ask for
The communication policy document: Request to see the section in the employee handbook that covers secure communication in public areas.
Look at
Whether it clearly outlines what employees should avoid discussing and the reasoning behind it.
Good evidence
Cites specific examples and aligns with organisational risks.
- Check 3 of 5What an auditor asks for
Ask for
Examples of communication technology in use: Request a list of secure apps or tools recommended by the IT team. Look to see if they are widely used and recognised for their security features.
Good evidence
Describes tools with strong encryption and user-friendly interfaces available to employees.
- Check 4 of 5What an auditor asks for
Ask for
Incident reports: Request documentation of any incidents where sensitive information was overheard or accidentally exposed.
Look at
How frequently these occur and the corrective actions taken.
Good evidence
Shows few to no incidents, with robust action plans for any occurrences.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of leadership commitment: Request records of management's efforts to communicate the importance of this control with examples.
Look at
Meeting minutes or communication from senior leaders.
Good evidence
Depicts senior leaders actively engaged in promoting secure communication.
Mappings
Closest match in ISO/IEC 27001: A.6.3, Information security awareness, education and training program, which this control covers in full and more.
ISO/IEC 27001: 2 mappings
This control is broader than A.6.3.
ISM-1644 addresses operational behaviour to prevent inadvertent disclosure during conversations in public areas. Annex A 6.3 requires an awareness, education, and training program so personnel understand and follow information security policies and procedures, including expectations about discussing sensitive matters in public. ISM-1644 is a specific rule to be taught and reinforced, whereas Annex A 6.3 is the broader mechanism for ensuring personnel know and comply with such rules.
This control partially meets A.5.10.
ISM-1644 requires that sensitive or classified phone calls and conversations are not conducted in public locations unless precautions are taken to prevent being overheard. Annex A 5.10 requires organisations to define and implement acceptable use rules and handling procedures for information and associated assets, which can include rules about verbal discussions and mobile phone use in public. ISM-1644 is a specific behavioural/operational rule about spoken communications, while Annex A 5.10 is broader policy coverage across many asset and information handling scenarios.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.