ASD ISM 0216 Ensure separate cabinets for TOP SECRET patch panels
What it says
TOP SECRET patch panels are installed in individual TOP SECRET cabinets.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishTOP SECRET patch panels must be within their own separate cabinets to enhance security.
This control means that if you're dealing with highly sensitive information, known as 'TOP SECRET', the cables that connect to these systems should be kept in their own locked cabinet. Doing this helps ensure that no unauthorised person can tamper with the connections and steal or modify this crucial data.
Free. Save your status, tasks and notes.
Why it matters
If TOP SECRET patch panels are not housed in individual TOP SECRET cabinets, unauthorised access or tampering could expose classified network links and compromise confidentiality.
How to implement
Facilities manager should work with the IT team to identify which patch panels handle TOP SECRET information.
This involves reviewing current cable management practices and marking which panels need enhanced physical security.
The IT team should source suitable cabinets designed specifically for security, ensuring they have features such as high-quality locks.
Consult with a trusted supplier to choose cabinets that meet the Australian Government security guidelines.
An office manager should designate and restrict access to the room where these cabinets are located.
This could involve updating access cards so only those with a TOP SECRET clearance can enter.
IT should regularly audit who has access to the TOP SECRET cabinets.
This includes maintaining an access log to record who opens these cabinets and when. Review logs monthly to ensure there are no irregularities.
HR should ensure that all personnel with access to these cabinets are appropriately cleared.
This involves checking staff clearances and ensuring they understand the importance of maintaining the confidentiality of the information.
Keep it running
Verify each TOP SECRET patch panel is installed in its own TOP SECRET cabinet; check cabinet labels, locks and seals, and record access to each cabinet in the access log.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
The floor plan showing cabinet locations: Request a map of the facility marking the locations of the TOP SECRET cabinets.
Look at
Clear labels indicating which cabinets are dedicated to TOP SECRET patch panels.
Good evidence
Shows an up-to-date map with all relevant cabinets clearly marked.
- Check 2 of 3What an auditor asks for
Ask for
To see the access control logs for the cabinet room: Examine the entry records for any unapproved entry attempts. Good records will show timestamps, names of individuals accessing, and verification checks.
- Check 3 of 3What an auditor asks for
Ask for
Them to describe the security protocols they follow for managing TOP SECRET patch panels. A detailed explanation of procedures and secure practices indicates effective implantation.
Good evidence
Result shows no signs of tampering and robust security hardware.
Mappings
Closest match in ISO/IEC 27001: A.7.5, Protecting against physical and environmental threats, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.5.
Annex A 7.5 requires organisations to implement protections against physical threats to infrastructure, including preventing unauthorised access and interference. ISM-0216 is a specific facility/cabling segregation control requiring TOP SECRET patch panels to be installed in individual TOP SECRET cabinets, reducing tampering and disclosure risk. Annex A 7.5 is broader as it applies to all infrastructure and includes environmental threats, not just TOP SECRET patch panel housing.
This control partially overlaps A.7.8.
Annex A 7.8 requires equipment to be securely sited and protected from unauthorised access and damage. ISM-0216 relates by prescribing that TOP SECRET patch panels be installed in individual TOP SECRET cabinets, which is a specific physical siting and protection requirement for high-classification infrastructure. ISM-0216 is highly specific to a component and classification, while Annex A 7.8 is general and applies to all equipment types and protection contexts.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.