# CISA’s mobile guidance for likely targets: encrypted messaging, FIDO keys, no SMS codes and no personal VPNs > CISA’s Mobile Communications Best Practice Guidance, version 2.0 of November 24, 2025, tells highly targeted people to assume mobile communications can be intercepted, use only end-to-end encrypted messaging, enroll key accounts in FIDO authentication, stop using SMS for MFA, keep phones and hardware current, and avoid personal VPNs. - Canonical URL: https://update.dsesecurity.com/updates/cisa-mobile-communications-best-practices-highly-targeted-executives-fido-e2ee/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-19T00:28:01+00:00 - Modified: 2026-10-19T01:55:07+00:00 - Last reviewed by DSE: 2026-10-19 - Resource type: Checklist - DSE priority: Advisory - Topics: Cybersecurity, IT - Reading time: 2 minutes ## What you need to know CISA’s Mobile Communications Best Practice Guidance, version 2.0 of November 24, 2025, tells highly targeted people to assume mobile communications can be intercepted, use only end-to-end encrypted messaging, enroll key accounts in FIDO authentication, stop using SMS for MFA, keep phones and hardware current, and avoid personal VPNs. ## Potentially affected Executives, board members, officials and others likely to be targeted, and the IT staff who manage their company and personal phones and accounts. ## DSE recommendation DSE recommends identifying the people most likely to be targeted and applying CISA’s mobile checklist to their phones and accounts first. ## Article CISA’s Mobile Communications Best Practice Guidance, version 2.0 of November 24, 2025, tells highly targeted people to assume mobile communications can be intercepted, use only end-to-end encrypted messaging, enroll key accounts in FIDO authentication, stop using SMS for MFA, keep phones and hardware current, and avoid personal VPNs. ## Source facts CISA’s [Mobile Communications Best Practice Guidance](https://www.cisa.gov/sites/default/files/2025-12/guidance-mobile-communications-best-practices_508c.pdf), version 2.0 dated November 24, 2025, responds to nation-state espionage against commercial telecommunications infrastructure that led to theft of customer call records. While applicable to all audiences, it is aimed at highly targeted people in senior government, military or political positions, who it says should assume communications between mobile devices and internet services are at risk of interception or manipulation. It recommends using only end-to-end encrypted messaging such as Signal, enrolling accounts such as Microsoft, Apple and Google in FIDO phishing-resistant authentication, with security keys most effective and passkeys acceptable, and not using SMS as a second factor because SMS messages are not encrypted. It warns that adding an authenticator app does not remove SMS, leaving a weak fallback, and also advises a password manager, weekly update checks with auto-update on, the latest phone hardware and no personal VPN, which it says shifts risk from the internet provider to the VPN provider. For iPhones it lists Lockdown Mode and turning off Send as Text Message; for Android it favors models with at least monthly security updates and a five-year update commitment, and RCS only with end-to-end encryption. For employer-issued devices, it says to verify that records retention policies allow message expiration before enabling it. ## Applicability Use this for people whose roles make them likely targets, on company and personal phones. Encrypted messaging and message expiration can conflict with records retention or legal hold duties, so check policy before using them for business. ## DSE recommendation DSE recommends identifying the people most likely to be targeted and applying CISA’s mobile checklist to their phones and accounts first. Issue them hardware security keys, remove SMS from sign-in and recovery where the service allows, keep their phones on current hardware and software, and confirm any encrypted messaging use fits records retention rules. ## Verification For each targeted person, record which accounts use FIDO keys, whether SMS is still enrolled, the phone model and update status, and when the checklist was last reviewed. ## Official reference [CISA — Mobile Communications Best Practice Guidance (version 2.0)](https://www.cisa.gov/sites/default/files/2025-12/guidance-mobile-communications-best-practices_508c.pdf). Reviewed October 19, 2026. ## Primary reference - Name: CISA — Mobile Communications Best Practice Guidance (version 2.0) - Authority: Cybersecurity and Infrastructure Security Agency - URL: https://www.cisa.gov/sites/default/files/2025-12/guidance-mobile-communications-best-practices_508c.pdf - Source publication date: Not stated by the source ## Citation and use Preferred citation: “CISA’s mobile guidance for likely targets: encrypted messaging, FIDO keys, no SMS codes and no personal VPNs,” DSE Security, https://update.dsesecurity.com/updates/cisa-mobile-communications-best-practices-highly-targeted-executives-fido-e2ee/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.