Search

Categories

System Hardening Cryptography gateways Networking System Management Communications Infrastructure Personnel Security Media software development Enterprise Mobility Communications Systems Procurement and Outsourcing cybersecurity roles Email Information Technology Equipment system monitoring Database Systems Physical Security Cyber Security Incidents Data Transfers

18 controls

Physical Security

ISM-0157

Data communicated over network infrastructure in areas not authorised for the processing of such data is encrypted as if it was communicated through unsecured spaces.

ISM-0161

IT equipment and media are secured when not in use.

ISM-0164

Unauthorised people are prevented from observing systems, in particular workstation displays and keyboards, within facilities.

ISM-0225

Unauthorised RF and IR devices are not brought into SECRET and TOP SECRET areas.

ISM-0810

Classified systems are secured in facilities that meet the requirements for a security zone suitable for their classification.

ISM-0813

Server rooms, communications rooms and security containers are not left in unsecured states.

ISM-0829

Security measures are used to detect and respond to unauthorised RF devices in SECRET and TOP SECRET areas.

ISM-1053

Classified servers, network devices and cryptographic equipment are secured in server rooms or communications rooms that meet the requirements for a security zone suitable for their classification.

ISM-1074

Keys or equivalent access mechanisms to server rooms, communications rooms and security containers are appropriately controlled.

ISM-1296

Physical security is implemented to protect network devices in public areas from physical damage or unauthorised access.

ISM-1530

Classified servers, network devices and cryptographic equipment are secured in security containers suitable for their classification taking into account the combination of security zones they reside in.

ISM-1543

An authorised RF and IR device register for SECRET and TOP SECRET areas is developed, implemented, maintained and verified on a regular basis.

ISM-1973

Non-classified systems are secured in suitably secure facilities.

ISM-1974

Non-classified servers, network devices and cryptographic equipment are secured in suitably secure server rooms or communications rooms.

ISM-1975

Non-classified servers, network devices and cryptographic equipment are secured in suitably secure security containers.

ISM-2007

An authorised medical device register for SECRET and TOP SECRET areas is developed, implemented, maintained and verified on a regular basis.

ISM-2008

Medical devices that are authorised to be brought into SECRET and TOP SECRET areas meet, at a minimum, the following criteria:<br>• are listed on the Australian Register of Therapeutic Goods<br>• have been prescribed by a legally qualified medical practitioner<br>• have been commercially purchased within Australia<br>• do not have inbuilt cellular connectivity<br>• are capable of operating independently of mobile devices<br>• where possible, have Wi-Fi, Bluetooth and other forms of wireless connectivity disabled when operating within SECRET and TOP SECRET areas.

ISM-2009

Unauthorised medical devices are not brought into SECRET and TOP SECRET areas.

Last updated May 21, 2025

The Information Security Manual and its controls are written by the Australian Cyber Security Centre.
Built with Hugo. Theme Stack designed by Jimmy