ASD ISM 0217 Secure separation of non-TOP SECRET and TOP SECRET panels
What it says
Where spatial constraints demand non-TOP SECRET patch panels be installed in the same cabinet as a TOP SECRET patch panel: - a physical barrier in the cabinet is provided to separate patch panels - only personnel holding a Positive Vetting security clearance have access to the cabinet - approval from the TOP SECRET system's authorising officer is obtained prior to installation.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishInstall barriers and restrict access to mix different security level patch panels in cabinets.
This control is about making sure that when you have equipment for handling regular and highly classified information in the same cabinet, they don't mix up. Think of it like storing your regular and secret files in a drawer: you'd want a divider between them and only let very trusted people access the drawer. This matters because if the equipment gets mixed, sensitive information might accidentally get exposed.
Free. Save your status, tasks and notes.
Why it matters
If non‑TOP SECRET and TOP SECRET patch panels share a cabinet without a barrier and PV-only access, cross-connection or tampering could expose TOP SECRET traffic.
How to implement
Facility manager should ensure physical barriers are installed: For cabinets containing both non-TOP SECRET and TOP SECRET equipment, install a physical barrier inside the cabinet to separate the two.
This might involve placing a heavy-duty divider to physically segregate the two sets of cables.
Security personnel should manage access approvals: Only allow individuals with Positive Vetting security clearance to access these cabinets.
Ensure they are listed in your access log system and conduct regular reviews of this list to ensure it is current.
System owner should obtain prior approvals: Before installing any mixed security level equipment, secure written permission from the authorising officer for the TOP SECRET system.
Keep a digital copy of this approval in a secure, organised folder.
IT team should conduct regular checks: Regularly inspect cabinets to ensure that the barriers are intact and no unauthorised changes have been made.
Set reminders in your work calendar to check these at least monthly.
Organisation's security officer should conduct briefing sessions: Brief any personnel with PV clearance on their responsibilities when accessing these cabinets.
This includes the importance of maintaining the physical barrier and reporting any issues.
Keep it running
Install/inspect an internal barrier separating panels, restrict cabinet keys to Positive Vetting staff, and retain TOP SECRET authorising officer approval before changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Access logs for the cabinet: Request the documented entry logs for the cabinet, showing who accessed it and when.
Look at
Names of individuals with Positive Vetting security clearance only.
Good evidence
Is a log displaying strict access records with documented times and personnel signatures.
- Check 2 of 5What an auditor asks for
Ask for
The service report or photographic evidence showing the presence of physical barriers in the cabinet.
Look at
The details of the installation date and contractor information.
Good evidence
Includes a recent service report or a timestamped photo showing the installed barrier.
- Check 3 of 5What an auditor asks for
Ask for
How often they access the cabinet and what protocols they follow.
Look at
Their understanding and adherence to security practices.
Good evidence
Is one where they can articulate the barrier's purpose and their responsibility in maintaining security.
- Check 4 of 5What an auditor asks for
Good evidence
Is an organised, systematic inspection process with no anomalies detected.
- Check 5 of 5What an auditor asks for
Ask for
The written approval for any mixed installation in the cabinet.
Look at
A clear authorisation with the officer's signature and date.
Good evidence
Is a neatly filed document indicating explicit consent from the authorising party.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.15.
ISM-0217 requires specific physical segregation and access control when non-TOP SECRET and TOP SECRET patch panels are co-located. This includes a physical barrier, PV-only access, and authorising officer approval. Annex A 5.15 encompasses broader access control policies for all assets, under which ISM-0217's requirements are a specific application.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.