What you need to know
CISA’s Mobile Communications Best Practice Guidance, version 2.0 of November 24, 2025, tells highly targeted people to assume mobile communications can be intercepted, use only end-to-end encrypted messaging, enroll key accounts in FIDO authentication, stop using SMS for MFA, keep phones and hardware current, and avoid personal VPNs.
Potentially affected
Executives, board members, officials and others likely to be targeted, and the IT staff who manage their company and personal phones and accounts.
DSE recommendation
DSE recommends identifying the people most likely to be targeted and applying CISA’s mobile checklist to their phones and accounts first.
CISA’s Mobile Communications Best Practice Guidance, version 2.0 of November 24, 2025, tells highly targeted people to assume mobile communications can be intercepted, use only end-to-end encrypted messaging, enroll key accounts in FIDO authentication, stop using SMS for MFA, keep phones and hardware current, and avoid personal VPNs.
Source facts
CISA’s Mobile Communications Best Practice Guidance, version 2.0 dated November 24, 2025, responds to nation-state espionage against commercial telecommunications infrastructure that led to theft of customer call records. While applicable to all audiences, it is aimed at highly targeted people in senior government, military or political positions, who it says should assume communications between mobile devices and internet services are at risk of interception or manipulation.
It recommends using only end-to-end encrypted messaging such as Signal, enrolling accounts such as Microsoft, Apple and Google in FIDO phishing-resistant authentication, with security keys most effective and passkeys acceptable, and not using SMS as a second factor because SMS messages are not encrypted. It warns that adding an authenticator app does not remove SMS, leaving a weak fallback, and also advises a password manager, weekly update checks with auto-update on, the latest phone hardware and no personal VPN, which it says shifts risk from the internet provider to the VPN provider.
For iPhones it lists Lockdown Mode and turning off Send as Text Message; for Android it favors models with at least monthly security updates and a five-year update commitment, and RCS only with end-to-end encryption. For employer-issued devices, it says to verify that records retention policies allow message expiration before enabling it.
Applicability
Use this for people whose roles make them likely targets, on company and personal phones. Encrypted messaging and message expiration can conflict with records retention or legal hold duties, so check policy before using them for business.
DSE recommendation
DSE recommends identifying the people most likely to be targeted and applying CISA’s mobile checklist to their phones and accounts first. Issue them hardware security keys, remove SMS from sign-in and recovery where the service allows, keep their phones on current hardware and software, and confirm any encrypted messaging use fits records retention rules.
Verification
For each targeted person, record which accounts use FIDO keys, whether SMS is still enrolled, the phone model and update status, and when the checklist was last reviewed.
Official reference
CISA — Mobile Communications Best Practice Guidance (version 2.0). Reviewed October 19, 2026.
Review the official source
CISA — Mobile Communications Best Practice Guidance (version 2.0) · Verified October 19, 2026
Need help applying this guidance safely?
DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.
Talk with DSE