ASD ISM 0462 Managing encryption access for IT equipment and media
What it says
When a user authenticates to the encryption functionality of IT equipment or media, it is treated in accordance with its original sensitivity or classification until the user deauthenticates from the encryption functionality.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishIT systems are treated according to their original sensitivity when accessed using encryption.
This control is about ensuring that when you use encrypted devices or storage, they are treated with the same security precautions as when they were originally secured. If not followed, you could accidentally expose sensitive information because people might assume these items are always safe without checking the security settings they're using.
Free. Save your status, tasks and notes.
Why it matters
If users stay authenticated to encryption, equipment/media must be treated at original classification; mishandling can cause classified data exposure.
How to implement
System owners should ensure all IT equipment and media with encryption are classified accurately based on their original sensitivity.
This can be done by reviewing the classification documents and confirming they match the device's purpose and data type.
The IT team should configure devices to require user authentication before accessing encrypted data.
Set up login prompts and passwords that align with the original sensitivity level and data classification standards.
Managers should implement clear policies for deauthentication from encrypted devices or media.
This involves instructing users to log out or detach access when finished, ensuring security is maintained when devices are idle.
HR should conduct regular training on encryption importance and usage for all employees accessing sensitive equipment.
Training materials should cover how to authenticate and deauthenticate properly and the reasons for these practices.
Procurement should coordinate with IT to acquire encryption solutions that support required authentication mechanisms.
When selecting products, verify that they allow easy implementation of existing classification levels.
Keep it running
Ensure devices/media remain handled at their original classification while users are authenticated to encryption; require prompt deauthentication when finished.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Equipment classification records: Request the documentation detailing the original sensitivity classification of IT devices and media.
Look at
Whether these records match current encryption setups and classifications.
Good evidence
All devices are listed with accurate classification and matching current security practices.
- Check 2 of 5What an auditor asks for
Look at
Consistency and completeness in login and logout information across periods of usual activity.
Good evidence
Logs show all interactions with encryption functions and maintain accuracy.
- Check 3 of 5What an auditor asks for
Ask for
The security policy documents: Request policies outlining procedures for encryption and access control.
Look at
Whether these policies clearly define responsibilities and procedures for using encrypted devices.
Good evidence
Policies are clear, comprehensive, and specifically cover authentication and deauthentication steps.
- Check 4 of 5What an auditor asks for
Look at
The frequency and coverage of training, ensuring all relevant personnel attended.
Good evidence
Recent, widespread training with clear agendas covering required encryption practices.
- Check 5 of 5What an auditor asks for
Ask for
Device procurement lists: Obtain lists of all encrypted devices with details on their authentication capabilities.
Look at
Whether device features align with the organisation's security and classification needs.
Good evidence
Devices capable of supporting authentication and classification requirements.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which partially overlaps with this control.
ISO/IEC 27001: 3 mappings
This control partially overlaps A.7.10.
ISM-0462 requires that authenticating to encryption does not reduce the sensitivity/classification of IT equipment or media while the user remains authenticated. Annex A 7.10 requires storage media to be managed through its lifecycle in accordance with classification and handling requirements, which includes ensuring encrypted media is still handled as per its classified contents. Annex A 7.10 is broader across lifecycle activities (transport/disposal), while ISM-0462 is specifically about how classification is treated during an encryption-authenticated session.
This control partially overlaps A.8.3.
ISM-0462 requires that when a user authenticates to encryption on IT equipment or media, the equipment/media is treated at its original sensitivity/classification until the user deauthenticates. Annex A 8.3 requires restricting access to information and associated assets in line with an access control policy, which can include controlling who may authenticate to encryption and thereby gain access to the plaintext. However, ISM-0462 is specifically about classification handling behaviour during an encryption-authenticated session, whereas Annex A 8.3 is broader access restriction across all assets and access methods.
This control supports A.5.12.
ISM-0462 requires that organisations treat IT equipment or media according to its original sensitivity/classification during the period a user is authenticated to encryption. Annex A 5.12 requires information to be classified based on confidentiality, integrity and availability needs, which establishes what the 'original sensitivity or classification' actually is. Without a defined classification scheme from Annex A 5.12, ISM-0462 cannot be applied consistently because there is no authoritative baseline classification to retain during encryption-authenticated access.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.