ASD ISM 0559 Restrict microphone and webcam use in SECRET areas
What it says
Microphones (including headsets and USB handsets) and webcams are not used with non-SECRET workstations in SECRET areas.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDon't use microphones or webcams on non-classified computers in areas handling SECRET projects.
In areas where top-secret projects are handled, it's crucial to avoid using microphones or webcams on computers that aren't dealing with classified information. This is important because these devices could accidentally record or share sensitive information, leading to security breaches and compromising the project.
Free. Save your status, tasks and notes.
Why it matters
Unauthorised audio/video capture in SECRET areas risks exposure of sensitive projects, potentially leading to leaks and security breaches.
How to implement
The IT team should physically inspect all workstations in SECRET areas to ensure no microphones or webcams are connected.
They can do this by visiting the area and visually checking each computer setup, removing any unauthorised devices found.
Managers should communicate this policy to staff and ensure everyone understands that only computers involved in SECRET projects can have microphones and webcams.
They can send an email reminder and conduct a brief meeting to explain the reasons and consequences clearly.
HR should update office policies and job descriptions to include this requirement in areas where SECRET projects are handled.
They can do this by revising current documents and informing all employees of the changes during an induction or training session.
The procurement team should ensure that no purchase orders for microphones or webcams are approved for SECRET areas unless explicitly authorised for classified use.
They can track this by implementing a checklist for equipment purchasing that flags unauthorised items.
System owners should set up and maintain a log of authorised equipment for machines in SECRET areas, ensuring microphones and webcams are not listed without proper clearance.
They can do this by keeping an updated Excel spreadsheet or similar tool accessible to authorised personnel only.
Keep it running
Periodically check non-SECRET workstations in SECRET areas have no webcams or microphones connected (incl. headsets/USB handsets), and brief staff on the prohibition.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of computers in SECRET areas: Request the inventory record detailing all devices and peripherals, focusing on audio and video equipment.
Look at
The list to ensure that devices such as microphones and webcams are absent from machines without clearance.
Good evidence
List will clearly show that no unauthorised equipment is in use.
- Check 2 of 5What an auditor asks for
Ask for
To see purchase orders and invoices for equipment: Request recent purchase documentation to ensure compliance with restrictions.
Look at
These documents for any microphone or webcam purchase evidence for SECRET areas.
Good evidence
Result shows no such purchases without explicit authorisation.
- Check 3 of 5What an auditor asks for
Ask for
The logs of authorised equipment: Request access to the logs mentioned by the system owners, detailing equipment use in SECRET areas.
Look at
Consistency in updates and entries that confirm compliance. Good logs are regularly updated and show no restricted devices are used without permission.
- Check 4 of 5What an auditor asks for
Ask for
Employees in SECRET areas about their understanding of the policy: Interview a random selection of staff to assess their awareness of microphone and webcam restrictions.
Look at
Responses that indicate a clear understanding and adherence to the policy.
Good evidence
Result shows staff are universally aware and compliant.
- Check 5 of 5What an auditor asks for
Ask for
A demonstration of policy communication: Request records of communication to staff about this control, such as emails or meeting minutes.
Look at
The details of these communications to ensure the message was clear and correctly targeted.
Good evidence
Includes thorough and clear documentation of the communicated policy.
Mappings
Closest match in ISO/IEC 27001: A.7.6, Security measures for working in secure areas, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.7.6.
Annex A 7.6 requires organisations to implement controls for working in secure areas that prevent compromise of sensitive information and activities. ISM-0559 relates by prohibiting microphones and webcams with non-SECRET workstations in SECRET areas, limiting audio/visual exfiltration opportunities while staff work in those areas. ISM-0559 is a specific secure-area device restriction encompassed by Annex A 7.6.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.