ASD ISM 0591Use Evaluated Peripheral Switches Securely
Official control statement
Evaluated peripheral switches are used when sharing peripherals between systems.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Use verified switches to safely share devices between different computer systems.
What this means in practice
This control is about using approved switches to connect your devices to different computer systems securely. It matters because if you use an unapproved switch, there is a risk of accidentally allowing sensitive information to move between systems that should remain separate, which could lead to data breaches.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Mar 2022
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Why it matters
Using non-evaluated switches for shared peripherals can lead to unintended data leaks between isolated systems, risking sensitive data exposure.
Operational notes
Regularly verify any peripheral switch used for shared devices is evaluated/approved, and replace non-evaluated units to prevent cross-domain data transfer.
Implementation tips
- IT team should choose evaluated peripheral switches: Identify switches that have been examined and approved by trusted authorities or standards. This can be done by referencing lists provided by the Australian Cyber Security Centre (ACSC) to ensure that the switches meet security standards.
- Procurement staff should buy only verified switches: Always purchase peripheral switches from reputable suppliers who provide devices with verified security credentials. Make sure to check for compliance certificates or endorsements from official cyber security bodies.
- System administrators should configure the switches properly: Set up the switches so they only allow necessary connections and block any unauthorised access. They should follow setup instructions from the manufacturer alongside security guidelines from the ACSC.
- Train employees on proper use: Office managers should organise training sessions for staff on how to correctly use the peripheral switches, highlighting the importance of maintaining the security settings and why it's risky to switch devices without approval.
- Conduct regular security reviews: The IT security team should routinely check that all peripheral switches in use are still compliant with the latest security updates and guidelines. This involves reviewing logs and testing connections to ensure no unintended data pathways exist.
Audit / evidence tips
- AskThe approved equipment list: Request documentation listing all peripheral switches in useLook atThe list for details such as the make and model of each switch and evidence of approval from the ACSCGoodWill show only switches that have been verified and no use of non-compliant models
- AskTo see the procurement records: Request records or receipts of purchasing transactions for peripheral switchesLook atThese records to ensure purchases only from authorised suppliers and check for any compliance certificates includedGoodDisplays complete documentation showing compliance checks
- AskConfiguration settings: Request current configuration files for installed peripheral switchesLook atCompliance with security standards set by the ACSC that restrict data flow between systemsGoodShows secure setups with no unauthorised pathways
- AskTraining logs: Request the training schedule and attendance records for sessions on secure switch usageLook atRecent training dates and high participation rates among relevant staffGoodProvides thorough training records with feedback collected from participants
- AskRecent security review reports: Request the latest reports on security assessments of peripheral switchesLook atThose reports for identified risks and actions taken to mitigate themGoodIncludes a documented assessment and resolution of any found issues
Cross-framework mappings
How ISM-0591 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
open_in_fullBroader than(1)expand_less | ||
| Annex A 8.1 | ISM-0591 requires organisations to use evaluated peripheral switches when sharing peripherals between systems to prevent security breache... | |
layersPartially meets(1)expand_less | ||
| Annex A 8.12 | ISM-0591 specifies the use of evaluated peripheral switches to mitigate the risk of data leakage or unauthorized command execution across... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Gateways
See all Guidelines for gateways controls, or browse the full ASD ISM library.