ASD ISM 0225 Prevent unauthorised RF and IR device entry
What it says
Unauthorised RF and IR devices are not brought into SECRET and TOP SECRET areas.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure no unauthorised RF or IR devices are brought into high-security areas.
This control is all about making sure that devices that use radio waves or infrared, like certain remote controls or wireless cameras, aren't accidentally brought into high-security areas by people who aren't supposed to have them. This matters because these devices can secretly transmit information, which could lead to sensitive data getting into the wrong hands.
Free. Save your status, tasks and notes.
Why it matters
Unauthorised RF/IR devices entering SECRET/TOP SECRET areas can exfiltrate classified data via wireless links, causing major security compromise.
How to implement
Security personnel should conduct regular checks: Security staff should routinely inspect people entering high-security areas to ensure they aren't carrying unauthorised RF and IR devices.
Use a list of authorised devices for reference and conduct manual or electronic screenings.
IT team should update security policies: The IT department should clearly outline in the organisation's security policy which RF and IR devices are allowed in specific security zones.
Disseminate this policy to all staff and provide training on identifying and reporting unauthorised devices.
Managers should educate staff: Managers should organise training sessions to educate employees about which devices are not permitted in sensitive areas and why.
Use a presentation or demo to explain the risks these devices pose to security.
Facilities team should implement signage: Facilities coordinators should put up clear signs at entry points to high-security zones reminding employees and visitors of the prohibition on unauthorised RF and IR devices.
Use simple language and visually striking designs for effectiveness.
Procurement team should manage device purchases: Ensure that all purchases of RF and IR devices are approved by the relevant security authority in the organisation to prevent unauthorised devices from being acquired and inadvertently brought into secure areas.
Keep it running
Screen entrants and bags at SECRET/TOP SECRET access points; prohibit unauthorised RF/IR devices; run periodic RF/IR sweeps and remove detections.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Security device screening logs: Request the logs that show the dates and times of security screenings and which devices were identified.
Look at
Patterns or gaps in screenings.
Good evidence
Includes consistent records of routine checks and follow-up actions on any incidents.
- Check 2 of 5What an auditor asks for
Ask for
The security policy document: Request the written policy covering RF and IR device restrictions.
Look at
Specific details on authorised device types and the procedures if unauthorised devices are found.
Good evidence
Is a comprehensive document, easily understood by staff.
- Check 3 of 5What an auditor asks for
Ask for
Them to describe the protocol for handling unauthorised devices.
Look at
Responses that reflect an understanding of the procedure and past enforcement experiences.
Good evidence
Includes accurate recall of the steps and examples of past actions.
- Check 4 of 5What an auditor asks for
Look at
How they execute the screening and what tools they use.
Good evidence
Shows thorough checks and correct use of screening technology, if applicable.
- Check 5 of 5What an auditor asks for
Ask for
Records of training sessions on security procedures regarding RF and IR devices.
Look at
Attendee lists, dates, and training content.
Good evidence
Includes documented sessions with clear training outcomes and high attendance rates.
Mappings
Closest match in ISO/IEC 27001: A.7.1, Physical security perimeters, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.7.1.
Annex A 7.1 requires security perimeters to be defined and used to protect areas containing information and associated assets. ISM-0225 relates by restricting what devices may cross the defined perimeter into SECRET and TOP SECRET areas, reducing the risk of compromise once inside the boundary. The ISO control is broader because it covers establishing and enforcing the perimeter itself, while ISM-0225 is a specific rule applied within high-security zones.
This control partially meets A.7.2.
ISM-0225 requires that unauthorised RF and IR devices are not brought into SECRET and TOP SECRET areas to reduce eavesdropping/exfiltration risk. ISO/IEC 27001:2022 Annex A 7.2 requires appropriate physical entry controls for secure areas, which can include screening people and items entering (e.g., device checks) and thus can be used to enforce the ISM-0225 prohibition. Annex A 7.2 is broader because it covers all secure-area entry control measures, not specifically RF/IR device prevention in high-classification zones.
This control partially meets A.7.6.
Annex A 7.6 requires organisations to design and implement security measures to control and protect how people work within secure areas. ISM-0225 relates by mandating a specific secure-area working rule: preventing unauthorised RF and IR devices from being brought into SECRET and TOP SECRET areas. ISM-0225 is one concrete measure within the broader set of procedural and physical controls envisaged by Annex A 7.6.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.