ASD ISM 1887 Implement remote locate and wipe for mobile security
What it says
Mobile devices are configured with remote locate and wipe functionality.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMobile devices should be set up to be located and wiped remotely to ensure security.
This control ensures that mobile devices are set up so they can be located or wiped clean remotely if they are lost or stolen. This is crucial because if a device with sensitive information falls into the wrong hands, it could lead to data breaches, loss of privacy, or financial harm. By enabling remote wipe and location tracking, you can protect against these risks by locking down devices immediately.
Free. Save your status, tasks and notes.
Why it matters
If remote locate/wipe is not enabled, a lost or stolen mobile can leak sensitive data and increase breach and compliance risk.
How to implement
IT team should configure devices: Ensure every mobile device used for work is registered with the company's mobile device management system.
This involves enrolling the device in software that allows you to track it and erase its data if necessary.
Office manager to maintain an inventory: Keep an updated list of all mobile devices in use, including who uses them and their current status.
Regularly review and verify that each device is properly registered for remote tracking and wiping.
Procurement staff should choose compatible devices: Ensure any new mobile phones or tablets purchased can support remote locate and wipe features.
This means checking with suppliers or the manufacturer for these capabilities before buying.
System owner to review settings: Periodically check that remote locate and wipe functions are correctly set up on each device.
This involves testing the functionalities to confirm they work as expected and making updates if needed.
HR to educate employees: Conduct training sessions for staff on the importance of mobile security and what to do if their device is lost or stolen.
Provide them with simple guides on initiating a remote wipe via the company's software.
Keep it running
Periodically validate remote locate and wipe works (including offline/MDM-triggered wipe) and confirm location services are enabled per device policy.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The mobile device inventory list: Verify that there is a document listing all mobile devices in use and check that each is linked to the management system.
Look at
Details like the device ID and user information.
Good evidence
Is a comprehensive, updated list showing successful registration of devices.
- Check 2 of 5What an auditor asks for
Look at
How the system initiates a wipe and how fast it executes.
Good evidence
Demonstration shows the device being wiped and then restored to a clean state.
- Check 3 of 5What an auditor asks for
Ask for
Records of recent device wipe incidents: Review reports showing when devices were remotely wiped and why.
Look at
Documented evidence of lost or stolen devices and the actions taken.
Good evidence
Report includes incident details, times, and confirmation emails of wipe actions.
- Check 4 of 5What an auditor asks for
Look at
Clear instructions and roles defined for staff in charge of managing devices.
Good evidence
Policy outlines steps taken in case of loss or theft.
- Check 5 of 5What an auditor asks for
Ask for
The employee training records: Verify that staff have been trained on mobile security, focusing on device loss protocols.
Look at
Schedules, attendance records, and training materials.
Good evidence
Record shows regular sessions with comprehensive content on remote wipe procedures.
Mappings
Closest match in ISO/IEC 27001: A.6.7, Remote working security measures, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.6.7.
ISM-1887 requires mobile devices to be configured with remote locate and remote wipe functionality to reduce risk from loss or theft. ISO/IEC 27001:2022 Annex A 6.7 requires security measures for remote working to protect information accessed or stored outside organisational premises, which can include managing and protecting mobile devices used remotely. ISM-1887 is a specific technical safeguard within the broader remote working security control, while Annex A 6.7 also covers people, process and other technical measures beyond locate/wipe.
This control partially meets A.8.1.
Annex A 8.1 requires protecting information stored on and accessible via endpoint devices, particularly against loss or theft. ISM-1887 mandates remote locate and wipe functionality for mobile devices, which directly mitigates data exposure by enabling rapid response to lost or stolen endpoints. ISM-1887 is a specific mobile security capability and therefore a subset of the broader endpoint protection expectations in Annex A 8.1.
This control partially meets A.8.9.
ISM-1887 requires a particular security configuration on mobile devices: remote locate and wipe must be enabled and usable. ISO/IEC 27001:2022 Annex A 8.9 requires configurations (including security configurations) for hardware, software, services and networks to be established, documented, implemented, monitored and reviewed. ISM-1887 fits as a concrete configuration requirement within the wider configuration management regime described by Annex A 8.9.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.