ASD ISM 1868 Restrictions on mobile device removable media
What it says
SECRET and TOP SECRET mobile devices do not use removable media unless approved beforehand by ASD.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSECRET and TOP SECRET devices need ASD approval to use removable media.
When dealing with highly sensitive information, like that on SECRET or TOP SECRET devices, it's crucial to control what data these devices can store or share. Removable media, like USB sticks, can make it easy to copy data and lose track of it, so getting approval from the Australian Signals Directorate (ASD) first helps ensure that only trusted drives are used, protecting the information from falling into the wrong hands.
Free. Save your status, tasks and notes.
Why it matters
Without ASD-approved removable media, SECRET/TOP SECRET data could be copied to unapproved media, enabling unauthorised disclosure and a serious security breach.
How to implement
The IT team should identify all mobile devices that handle SECRET and TOP SECRET information and create a list of these devices.
This involves checking the inventory records and ensuring each device's security level is correctly classified.
The system administrator must block the use of removable media on SECRET and TOP SECRET devices by default.
This can be done by configuring device settings to disable USB ports or using software tools that control which devices can connect.
Managers should establish a procedure for requesting approval from the ASD for using removable media on these sensitive devices.
This involves creating a template that outlines what information needs to be provided for the ASD's review and who in the organisation will handle these requests.
The IT security officer should educate staff about the risks associated with using removable media on SECRET and TOP SECRET devices.
They can hold training sessions that explain why these restrictions are important and the proper procedures for seeking ASD approval.
The compliance officer should conduct regular reviews to ensure that the policy on removable media use is being followed.
This involves checking logs and records to verify that no unauthorised devices have been connected to SECRET or TOP SECRET devices.
Keep it running
Before any removable media is used on SECRET or TOP SECRET mobile devices, confirm ASD approval is documented and periodically re-validate approvals remain current.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The inventory list of SECRET and TOP SECRET devices.
Look at
Whether each device is appropriately classified and if the list is up-to-date.
Good evidence
Will show a regularly updated list with accurate classifications and device details.
- Check 2 of 5What an auditor asks for
Look at
Whether USB ports are disabled by default or if specific software is managing device connections.
Good evidence
Includes policy settings or software output showing removable media blocking on sensitive devices.
- Check 3 of 5What an auditor asks for
Ask for
The approval process documentation for using removable media on sensitive devices.
Look at
The steps outlined and any recent requests made to the ASD.
Good evidence
Includes a clear process description and records of communication with the ASD.
- Check 4 of 5What an auditor asks for
Look at
Attendance records, training materials, and quizzes or assessments completed by staff.
Good evidence
Includes dated records showing participation and understanding of the policy and its importance.
- Check 5 of 5What an auditor asks for
Ask for
The logs or reports from compliance reviews regarding the policy.
Look at
The frequency of the reviews and any incidents or exceptions noted.
Good evidence
Provides detailed review outcomes and any actions taken to address non-compliance.
Mappings
Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.1.
ISM-1868 requires that SECRET and TOP SECRET mobile devices do not use removable media unless ASD approval is obtained beforehand. Annex A 8.1 requires protection of information stored on, processed by, or accessible via user endpoint devices, which includes controlling risky peripherals and storage interfaces (such as removable media) on mobile devices. ISM-1868 is a specific, high-assurance restriction for a particular classification and device context, whereas Annex A 8.1 is broader and less prescriptive about approvals and classification-specific prohibitions.
This control partially meets A.8.12.
ISM-1868 requires a strong preventative control: SECRET and TOP SECRET mobile devices must not use removable media unless ASD approval is granted in advance. Annex A 8.12 requires data leakage prevention measures across systems and devices to prevent unauthorised exfiltration of sensitive information. Restricting removable media on high-classification mobiles (ISM-1868) directly strengthens DLP objectives by reducing a common offline exfiltration channel, but Annex A 8.12 also covers many other leakage vectors (network, cloud, printing) not addressed by ISM-1868.
This control depends on A.5.10.
ISM-1868 requires that removable media is not used on SECRET and TOP SECRET mobile devices unless ASD approval is obtained beforehand. Annex A 5.10 requires acceptable use rules and handling procedures for information and associated assets, which would normally codify prohibitions and the conditions under which removable media may be used. ISM-1868 is a specific classified-device rule, while Annex A 5.10 provides the organisational acceptable-use framework needed to communicate and operationalise that rule.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.