ASD ISM 0501 Transport of keyed cryptographic equipment
What it says
Keyed cryptographic equipment is transported based on the sensitivity or classification of its keying material.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCryptographic equipment is moved securely depending on the sensitivity of its keys.
Transporting cryptographic equipment safely and securely is crucial because it often holds sensitive keys that can unlock sensitive information. If these keys fall into the wrong hands, it could lead to unauthorised access and potential data breaches, harming your business's reputation and financial security.
Free. Save your status, tasks and notes.
Why it matters
If keyed cryptographic equipment is transported without safeguards matching the key material classification, keys may be exposed, enabling decryption and unauthorised system access.
How to implement
The IT manager should assess the sensitivity of the cryptographic equipment before transport.
This involves reviewing the classification level of the keying material and consulting any relevant policies or guidelines on its sensitivity.
Logistics personnel responsible for equipment movement should ensure secure transport methods are used, such as sealed delivery containers or using trusted couriers.
They should verify that all personnel handling the equipment have appropriate clearances.
Before transport, the security officer should document a transport plan that outlines who is responsible for the delivery, the route taken, and the estimated delivery time.
This document should be shared with all relevant parties.
The system owner should conduct a briefing for all transport personnel, highlighting the importance of maintaining the integrity and security of the equipment.
This should include emergency contacts and procedures if the equipment is compromised.
After delivery, the receiving party (often the intended IT or security team) should inspect the equipment for any signs of tampering.
They should communicate acceptance and confirm that the equipment arrived as expected, intact and secure.
Keep it running
Transport keyed cryptographic equipment using controls matched to the keying material classification (e.g., courier/escort, tamper-evident packaging), and maintain documented chain-of-custody at each handover.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The equipment transport log: Request the logs detailing the transportation of cryptographic equipment.
Look at
Entries on the date, personnel involved, and transport method.
Good evidence
Includes comprehensive logs with all details and no unexplained gaps.
- Check 2 of 5What an auditor asks for
Ask for
Security clearance records of personnel involved: Request to see the clearance levels of those who handled the cryptographic equipment.
Look at
Their access authorisations and validity. Good records show all personnel had the required clearances.
- Check 3 of 5What an auditor asks for
Ask for
The transport plan document: Request the documented transport plan used for the equipment.
Look at
Details on responsibilities, transport route, and contingency plans.
Good evidence
Contains a clearly defined plan that all parties signed off on.
- Check 4 of 5What an auditor asks for
Ask for
Delivery confirmation: Request evidence of the final delivery confirmation.
Look at
Signatures or digital confirmations from the receiving party.
Good evidence
Confirmation indicates that the equipment was received intact and securely.
- Check 5 of 5What an auditor asks for
Ask for
Incident reports regarding transport: Request any incident reports related to equipment transport.
Look at
Reports detailing any safety breaches or unusual occurrences.
Good evidence
Protocol has no incidents reported, or if there are, they are resolved with clear steps taken.
Mappings
Closest match in ISO/IEC 27001: A.5.12, Information classification policy and practices, which this control supports.
ISO/IEC 27001: 1 mapping
This control supports A.5.12.
ISM-0501 requires transport controls for keyed cryptographic equipment to be selected based on the sensitivity/classification of the keying material. Annex A 5.12 requires an organisation to classify information based on security needs (confidentiality, integrity, availability) and requirements. In practice, ISM-0501 depends on having a classification scheme (per Annex A 5.12) so that the sensitivity of keying material can be determined and the correct transport method applied.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.