ASD ISM 1867 Use approved mobile platforms for sensitive access
What it says
Mobile devices that access OFFICIAL: Sensitive or PROTECTED systems or data use mobile platforms that have completed a Common Criteria evaluation against the Protection Profile for Mobile Device Fundamentals, version 3.3 or later, and are operated in accordance with the latest version of their associated ASD security configuration guide.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMobile devices must use evaluated platforms for secure access to sensitive systems or data.
This control ensures that mobile devices accessing sensitive or protected systems use platforms that meet specific security standards and are configured securely. This is crucial because if these devices aren't secure, confidential information could be exposed, leading to financial loss, reputation damage, or compromised operations.
Free. Save your status, tasks and notes.
Why it matters
Using mobile platforms not Common Criteria-evaluated or not configured to ASD guidance increases risk of OFFICIAL: Sensitive/PROTECTED data compromise and unauthorised access.
How to implement
IT team should verify the mobile platforms: Ensure that the mobile devices used in the organisation have been evaluated for security by checking against the Common Criteria certification.
They can find this information on the Australian Cyber Security Centre's (ACSC) website.
Procurement team should choose compliant devices: When purchasing new mobile devices, check that they meet the required security standards by looking at the manufacturer's documentation and ensuring it mentions a valid Common Criteria certification.
IT team should apply security guides: Manage the configuration of mobile devices to align with the latest ASD (Australian Signals Directorate) security configuration guide.
This involves adjusting settings to recommended levels to prevent unauthorised access.
Managers should establish usage policies: Create clear policies about which mobile devices can be used to access sensitive data, ensuring employees only use approved devices.
Communicate this through regular staff meetings and enforce with monitoring.
Security team should routinely update device configurations: Periodically review and update the mobile devices' configurations and ensure they adhere to the latest security guides.
This might involve checking settings, installing updates, or tweaking configurations as recommended.
Keep it running
Regularly verify devices remain Common Criteria-evaluated (PP MDF v3.3+) and are still aligned to the latest ASD security configuration guide after OS/app updates.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of all mobile devices used in the organisation: Request an inventory document that includes details about each device's model and certification status.
Look at
Devices that are certified against the Common Criteria evaluation.
Good evidence
Shows up-to-date information on every device's certification.
- Check 2 of 5What an auditor asks for
Ask for
To see the procurement policy: Request the document that outlines how new mobile devices are selected and purchased.
Look at
Clauses that specify the need for devices to meet Common Criteria standards.
Good evidence
Is a policy document that clearly states the security requirements for purchasing mobile devices.
- Check 3 of 5What an auditor asks for
Ask for
Configuration guides: Request the ASD security configuration guides applied to organisation devices.
Look at
The guides and check for the latest versions being used.
Good evidence
Includes the most recent guides with dates showing they have been applied recently.
- Check 4 of 5What an auditor asks for
Ask for
User policy documentation: Request the documented policies that detail how employees can use mobile devices for sensitive access.
Look at
Clear instructions about approved devices and user responsibilities.
Good evidence
Is a comprehensive policy handbook available to all employees.
- Check 5 of 5What an auditor asks for
Ask for
A recent configuration report: Request a report that shows the current security settings of mobile devices in use within the organisation.
Look at
Any discrepancies between these settings and the ASD's recommendations.
Good evidence
Includes reports that show full compliance with these standards.
Mappings
Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.1.
Annex A 8.1 requires organisations to protect information stored on, processed by, or accessible via endpoint devices. ISM-1867 strengthens endpoint assurance by requiring evaluated mobile platforms and operation in accordance with ASD configuration guidance for devices accessing OFFICIAL: Sensitive or PROTECTED systems/data. ISM-1867 is a specialised platform assurance requirement and represents one way to meet Annex A 8.1, but Annex A 8.1 remains broader across device types and control measures.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.