Search

Categories

System Hardening Gateways Cryptography Networking System Management Communications Infrastructure Personnel Security Media Enterprise Mobility Software Development Communications Systems Procurement and Outsourcing Email Information Technology Equipment Cyber Security Roles Database Systems Cyber Security Incidents Data Transfers System Monitoring ICT Equipment

12 controls

Physical Security

ISM-0157

Data communicated over network infrastructure in areas not authorised for the processing of such data is encrypted as if it was communicated through unsecured spaces.

ISM-0161

IT equipment and media are secured when not in use.

ISM-0164

Unauthorised people are prevented from observing systems, in particular workstation displays and keyboards, within facilities.

ISM-0225

Unauthorised RF and IR devices are not brought into SECRET and TOP SECRET areas.

ISM-0810

Systems are secured in facilities that meet the requirements for a security zone suitable for their classification.

ISM-0813

Server rooms, communications rooms, security containers and secure rooms are not left in unsecured states.

ISM-0829

Security measures are used to detect and respond to unauthorised RF devices in SECRET and TOP SECRET areas.

ISM-1053

Servers, network devices and cryptographic equipment are secured in server rooms or communications rooms that meet the requirements for a security zone suitable for their classification.

ISM-1074

Keys or equivalent access mechanisms to server rooms, communications rooms, security containers and secure rooms are appropriately controlled.

ISM-1296

Physical security is implemented to protect network devices in public areas from physical damage or unauthorised access.

ISM-1530

Servers, network devices and cryptographic equipment are secured in security containers or secure rooms suitable for their classification taking into account the combination of security zones they reside in.

ISM-1543

An authorised RF and IR device register for SECRET and TOP SECRET areas is developed, implemented, maintained and verified on a regular basis.

Last updated October 1, 2024

The Information Security Manual and its controls are written by the Australian Cyber Security Centre.
Built with Hugo. Theme Stack designed by Jimmy