ASD ISM 0418 Keep physical credentials separate from systems
What it says
Physical credentials are kept separate from systems they are used to authenticate to, except for when performing authentication activities.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishStore physical credentials away from systems except when logging in.
This control is about making sure your physical keys or access cards aren't left lying around near the computers or servers they unlock. This matters because if someone found them, they could easily access your systems and potentially steal data or cause harm to your business.
Free. Save your status, tasks and notes.
Why it matters
Leaving physical credentials near systems exposes them to unauthorised access, risking data theft or service disruption.
How to implement
Office Managers should create a designated secure location for storing physical credentials, like keys or access cards.
Use a locked cabinet or safe that only authorised staff can access.
IT teams should educate staff about the importance of securely storing physical credentials when not in use.
This can be done through regular training sessions and reminders in team meetings.
Business Owners should develop a policy that outlines how physical credentials should be handled and stored.
Make sure all employees read and acknowledge this policy as part of their onboarding process.
HR departments should keep track of who is issued each physical credential and conduct regular audits.
This involves maintaining an up-to-date register showing which employees have which credentials.
Security personnel should implement a check-out/check-in process for physical credentials, especially if they are used by multiple staff.
Staff should log when they take and return credentials, ensuring accountability.
Keep it running
Store access cards/keys away from the system when not authenticating; confirm return after use and record any exceptions to identify weak practices.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The physical credential storage policy document: Request the written policy that describes how credentials should be securely stored.
Look at
Clear instructions and an acknowledgment section signed by employees.
Good evidence
Includes specific storage procedures and staff responsibilities.
- Check 2 of 5What an auditor asks for
Ask for
Staff members how they handle their access cards or keys when not in use.
Good evidence
Is they describe storing them in a secure, designated place as outlined in the policy.
- Check 3 of 5What an auditor asks for
Good evidence
Shows a clearly defined, secure storage area accessible only to authorised personnel.
- Check 4 of 5What an auditor asks for
Look at
Entries showing when employees check out and return credentials.
Good evidence
Is an up-to-date and accurately maintained log.
- Check 5 of 5What an auditor asks for
Ask for
To see training records that indicate staff have been informed about credential handling procedures.
Good evidence
Includes recent training sessions and acknowledgment by new and existing employees.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
ISM-0418 requires a specific rule for handling physical credentials: keep them separate from the systems they authenticate to except during authentication. Annex A 5.15 requires organisations to establish and implement access control policies and procedures covering both physical and logical access based on business and security requirements. ISM-0418 is an example of a concrete procedural requirement that would typically sit under an Annex A 5.15 access control policy, but it does not by itself cover the full policy and procedural scope demanded by Annex A 5.15.
This control partially overlaps A.8.5.
ISM-0418 requires physical credentials to be stored separately from the systems they authenticate to reduce the chance of immediate compromise if a system is accessed. Annex A 8.5 requires secure authentication technologies and procedures, which include procedural controls around protecting authenticators (including physical tokens) from loss, theft, or easy use. The overlap is procedural protection of authenticators, but Annex A 8.5 spans broader authentication design and management whereas ISM-0418 is narrowly focused on physical co-location and handling at the point of use.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.