CISA's Mobile Communications Best Practice Guidance asks highly targeted people to use end-to-end encrypted messaging, phishing-resistant sign-in, a carrier PIN, a password manager, prompt updates and current hardware. It was written for senior government, military and political staff, but executives with sensitive information can use the same list.
Who the guidance is for
The document says it applies to all audiences but addresses people in senior government, military or political positions who likely hold information of interest to nation-state actors. It grew out of reported intrusions into commercial telecommunications infrastructure. The version we reviewed is 2.0, dated November 2025.
Most executives are not the intended audience. Many hold material nonpublic information, deal plans or customer data, though, and that makes them a reasonable target for fraud and espionage alike. Treat the list as a ceiling you can approach, not a floor you must hit on day one.
The checklist
- Use end-to-end encrypted messaging for anything sensitive. CISA names Signal as an example and suggests an app that works across iPhone and Android.
- Enroll important accounts in FIDO authentication. Hardware keys are the strongest option, and passkeys are an acceptable alternative. Once enrolled, disable weaker second factors on that account.
- Stop using SMS codes as a second factor where you can. Remember that some services still fall back to SMS during account recovery.
- Use a password manager and protect the vault with a long, unique, random passphrase.
- Set a PIN on your mobile carrier account. It is required for sensitive steps such as moving your number to another provider.
- Update regularly. CISA suggests checking weekly and turning on automatic updates.
- Use recent phone hardware. Newer hardware has security features older models cannot get through software updates.
Two items that surprise people
CISA advises against a personal VPN. The reasoning is that a personal VPN moves risk from your internet provider to the VPN company and can widen the attack surface. A VPN your employer requires is a different case.
On iPhone, the guidance also lists Lockdown Mode, turning off the setting that sends messages as SMS when iMessage is unavailable, and reviewing app permissions. On Android it lists choosing a model with long update commitments, using RCS only with end-to-end encryption, and keeping Play Protect and Safe Browsing protection on.
What to do first
If you have one hour, do three things. Put a PIN on your carrier account. Move email and your phone ecosystem account (Apple, Google or Microsoft) to a passkey or hardware key. Then remove SMS as a sign-in option on those accounts.
If you have a second hour, turn on message expiry in your messaging app and check its linked devices list. Remove any device you do not recognize.
What not to over do
Do not copy a government threat model wholesale. Lockdown Mode, for example, switches off features you may rely on. Read what it limits before you enable it, and see our post on who should turn on Lockdown Mode. Message expiry on a company phone may conflict with records retention rules, and CISA itself says to check that first.
Quick check
Is this guidance only for government officials?
No. CISA says it applies to all audiences, though it specifically addresses highly targeted people in senior government, military or political roles.
Does CISA recommend a personal VPN?
No. It advises against personal VPNs for this audience, and treats an employer required VPN as a separate case.
Sources
- CISA, Mobile Communications Best Practice Guidance
- CISA, Mobile Communications Best Practice Guidance, version 2.0 PDF
Last reviewed: 19 October 2026.
