ASD ISM 1886 Ensure mobile devices operate in supervised mode
What it says
Mobile devices are configured to operate in a supervised (or equivalent) mode.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMobile devices must be set to a supervised mode to maintain security controls.
Mobile devices in your organisation should be set to run in a supervised mode. This is important because it allows you to control security settings effectively, preventing malicious apps or harmful changes that could lead to data breaches or loss.
Free. Save your status, tasks and notes.
Why it matters
Without supervised mode, users can install unauthorised apps or bypass MDM controls, increasing risk of data leakage and compromise.
How to implement
IT team should ensure that all new smartphones and tablets are set up in supervised mode during initial configuration.
This involves using the device's management software to access enhanced security features that can't be changed by employees.
The IT manager should create a checklist to confirm that supervised mode is enabled on existing devices during routine checks.
They can follow device manufacturer instructions to enable supervised mode and use mobile management tools to verify settings.
Managers should schedule regular training sessions with employees to explain why supervised mode is used and how it helps keep company data safe.
This can involve practical demonstrations and Q&A for common concerns.
Procurement should ensure that any mobile device purchases for the organisation specify compatibility with supervised mode.
This involves checking device specifications and consulting with suppliers during the buying process.
HR should update the mobile device policy to include the requirement of supervised mode, ensuring everyone understands this is a mandatory security measure.
This policy update should be communicated during onboarding and through regular policy reminders.
Keep it running
Use MDM to enforce supervised mode at enrolment; regularly report and remediate any devices not in supervised state (re-enrol or quarantine).
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The current mobile device inventory list: Request a document that lists all devices in use by the organisation.
Look at
Whether each device is marked as supervised.
Good evidence
Is an up-to-date list where all devices have 'supervised' noted along with last verification dates.
- Check 2 of 5What an auditor asks for
Ask for
The mobile device management (MDM) software settings report: Request a printout or screenshot showing supervised mode settings.
Look at
Whether supervised mode is enabled on all accounts. Good is when reports show consistent presence of supervised mode settings for all devices.
- Check 3 of 5What an auditor asks for
Ask for
Incident response logs related to mobile devices: Request these logs to see if any security issues were tracked back to unsupervised devices.
Look at
Incidents that mention non-supervised mode. It's good if there are few or no such incidents, showing effective supervised mode use.
- Check 4 of 5What an auditor asks for
Ask for
Staff training records on device security: Request these to ensure staff have been educated about the importance of supervised mode. Check for attendance and feedback notes. Good is comprehensive records showing regular training sessions with positive feedback.
- Check 5 of 5What an auditor asks for
Ask for
Procurement files for recent mobile device purchases: Review specifications for any new devices.
Look at
Purchase orders or contracts specifying supervised capability. It's good if all procurement documents highlight supervised mode as a requirement.
Mappings
Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.1.
ISM-1886 requires mobile devices to be configured to operate in supervised (or equivalent) mode to enforce stronger device management and security controls. This relates directly to ISO/IEC 27001:2022 Annex A 8.1, which requires protection of information on or accessible via user endpoint devices, including mobiles. ISM-1886 is a specific technical configuration approach for mobiles, while Annex A 8.1 is broader and technology-agnostic across all endpoint device types and protective measures.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.