ASD ISM 2108 Mobile apps encrypt sensitive data using ASD-approved cryptography
What it says
Mobile applications encrypt all sensitive or classified data communicated over public network infrastructure using ASD-approved cryptography.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMobile apps must encrypt all sensitive or classified data sent over public networks using cryptography approved by the Australian Signals Directorate (ASD).
When a mobile app on a phone or tablet sends sensitive or classified information across public networks (like the internet or mobile data), that information must be scrambled so outsiders cannot read it. The scrambling method (called cryptography or encryption) has to be one that the Australian Signals Directorate (ASD), the government's cyber security agency, has approved. This protects your organisation's data from being intercepted and read while it travels between the app and wherever it is going.
Free. Save your status, tasks and notes.
Why it matters
If a mobile app sends sensitive or classified data over public networks without ASD-approved encryption, attackers can intercept and read that data in transit, leading to a serious data breach.
How to implement
The IT manager should compile a list of every mobile app the organisation uses that sends sensitive or classified data, then confirm with each app vendor or by checking technical documentation that the app uses encryption when communicating over public networks.
The IT team should verify that the encryption used by each mobile app appears on the ASD-approved cryptography list (published by the Australian Signals Directorate), and record the specific algorithm or protocol each app relies on (for example, TLS with an approved cipher).
The person managing mobile devices should configure organisation-issued phones and tablets so apps cannot send sensitive data over unencrypted connections, for example by enforcing settings through a Mobile Device Management (MDM) platform.
The business owner or IT lead should reject or remove any mobile app that cannot demonstrate it encrypts sensitive data in transit with ASD-approved cryptography, replacing it with a compliant alternative.
The IT team should retest encryption after each major app update or operating system change, since updates can alter how an app handles data sent over public networks, and keep dated records of each check.
Keep it running
Recheck each app's encryption against the current ASD-approved cryptography list periodically and after every app or operating system update, as approved algorithms and app behaviour both change over time.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the inventory of mobile apps that handle sensitive or classified data.
Look at
whether each entry records the encryption method used in transit.
Good evidence
is a maintained list naming every relevant app and the specific cryptography it uses over public networks.
- Check 2 of 5What an auditor asks for
Ask for
the IT team to show that the encryption each app uses is on the ASD-approved cryptography list.
Look at
the named algorithms or protocols against the current Australian Signals Directorate guidance.
Good evidence
maps each app to a named, currently approved cryptographic standard.
- Check 3 of 5What an auditor asks for
Ask for
evidence that data cannot be sent unencrypted, such as Mobile Device Management (MDM) configuration or app settings.
Look at
the enforced policy.
Good evidence
shows technical controls that block sensitive data from travelling over public networks without encryption.
- Check 4 of 5What an auditor asks for
Ask for
how the organisation tests that encryption actually works in practice.
Look at
test results, network capture summaries, or vendor attestations.
Good evidence
includes dated evidence confirming traffic is encrypted, not just an assumption it is.
- Check 5 of 5What an auditor asks for
Ask for
what happens when an app cannot meet the requirement.
Look at
records of apps that were rejected, removed, or remediated.
Good evidence
shows a clear process for removing or replacing non-compliant apps and dated examples of it being applied.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-2108 requires mobile applications to encrypt all sensitive or classified data sent over public networks using ASD-approved cryptography. ISO/IEC 27001:2022 Annex A 8.24 requires the organisation to define and implement rules for cryptography use and cryptographic key management, which would govern choices such as approved algorithms and key handling for mobile app communications. ISM-2108 is a specific application of cryptography requirements (mobile apps, data-in-transit over public networks, ASD-approved), whereas Annex A 8.24 is broader and policy/management-system oriented across the organisation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.