E2EE Messaging
CISA strongly recommends Signal for all communications.
Mobile Hardening Guide
Ensure the safety and security of your mobile devices with guidelines tailored for Android and iOS.
Official Security Guidance
Section titled “Official Security Guidance”Authoritative recommendations from government agencies.
NSA Best Practices Essential one-page infographic.
CISA Mobile Guidance Latest 2025 best practices.
NIST SP 800-124 Enterprise management guidelines.
CIS Benchmarks Technical configuration details.
Critical Recommendations (2024-2025)
Section titled “Critical Recommendations (2024-2025)”Kill the SMS 2FA
Do NOT use SMS for MFA. SIM-swapping increased by 1,055% in some regions in 2024.
Personal VPNs
CISA advises against commercial VPNs for personal use as they often simply shift risk to the VPN provider.
Modern Hardware
Use the latest hardware; software updates alone cannot provide hardware-level security features.
Platform-Specific Hardening
Section titled “Platform-Specific Hardening”Critical iOS Settings
Section titled “Critical iOS Settings”- Enable Lockdown Mode: Settings → Privacy & Security → Lockdown Mode. (For high-risk targets).
- Stolen Device Protection: Settings → Face ID & Passcode → Enable.
- USB Accessories: Settings → Face ID & Passcode → Require Unlock.
- Significant Locations: Disable in Privacy → Location Services → System Services.
App Management
Section titled “App Management”- Only install from the Official App Store.
- Review Tracking Permissions regularly.
Hardened Android OS
Section titled “Hardened Android OS”For maximum security, consider a hardened ROM:
- GrapheneOS: The gold standard for security (Pixel only).
- CalyxOS: Privacy-focused with broader support.
Stock Android Settings
Section titled “Stock Android Settings”- Google Play Protect: Enable in Play Store → Profile.
- Find My Device: Enable in Settings → Security.
- Unknown Sources: Keep disabled in Security settings.
- Developer Options: Keep disabled unless actively debugging.
F-Droid Store
Section titled “F-Droid Store”Use F-Droid for privacy-respecting, open-source apps.
Universal Security Checklist
Section titled “Universal Security Checklist”- Strong PIN: Use 6+ digits (avoid birthdates/sequences).
- Weekly Reboot: NSA recommends restarting at least once per week.
- Auto-Lock: Set to 5 minutes or less.
- SIM PIN: Prevent your SIM from being used in another device.
- App Minimalist: Delete unused apps and minimize permissions.
Recommended Apps
Section titled “Recommended Apps”Passwords
Authentication
Messaging
Privacy