Search

Categories

System Hardening Cryptography Gateways Networking System Management Communications Infrastructure Personnel Security Media Enterprise Mobility Software Development Communications Systems Procurement and Outsourcing Cyber Security Roles Email Information Technology Equipment Cyber Security Incidents Database Systems System Monitoring Data Transfers Physical Security

15 controls

Physical Security

ISM-0157

Data communicated over network infrastructure in areas not authorised for the processing of such data is encrypted as if it was communicated through unsecured spaces.

ISM-0161

IT equipment and media are secured when not in use.

ISM-0164

Unauthorised people are prevented from observing systems, in particular workstation displays and keyboards, within facilities.

ISM-0225

Unauthorised RF and IR devices are not brought into SECRET and TOP SECRET areas.

ISM-0810

Classified systems are secured in facilities that meet the requirements for a security zone suitable for their classification.

ISM-0813

Server rooms, communications rooms and security containers are not left in unsecured states.

ISM-0829

Security measures are used to detect and respond to unauthorised RF devices in SECRET and TOP SECRET areas.

ISM-1053

Classified servers, network devices and cryptographic equipment are secured in server rooms or communications rooms that meet the requirements for a security zone suitable for their classification.

ISM-1074

Keys or equivalent access mechanisms to server rooms, communications rooms and security containers are appropriately controlled.

ISM-1296

Physical security is implemented to protect network devices in public areas from physical damage or unauthorised access.

ISM-1530

Classified servers, network devices and cryptographic equipment are secured in security containers suitable for their classification taking into account the combination of security zones they reside in.

ISM-1543

An authorised RF and IR device register for SECRET and TOP SECRET areas is developed, implemented, maintained and verified on a regular basis.

ISM-1973

Non-classified systems are secured in suitably secure facilities.

ISM-1974

Non-classified servers, network devices and cryptographic equipment are secured in suitably secure server rooms or communications rooms.

ISM-1975

Non-classified servers, network devices and cryptographic equipment are secured in suitably secure security containers.

Last updated February 1, 2025

The Information Security Manual and its controls are written by the Australian Cyber Security Centre.
Built with Hugo. Theme Stack designed by Jimmy