ASD ISM 0591 Use evaluated peripheral switches securely
What it says
Evaluated peripheral switches are used when sharing peripherals between systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse verified switches to safely share devices between different computer systems.
This control is about using approved switches to connect your devices to different computer systems securely. It matters because if you use an unapproved switch, there is a risk of accidentally allowing sensitive information to move between systems that should remain separate, which could lead to data breaches.
Free. Save your status, tasks and notes.
Why it matters
Using non-evaluated switches for shared peripherals can lead to unintended data leaks between isolated systems, risking sensitive data exposure.
How to implement
IT team should choose evaluated peripheral switches: Identify switches that have been examined and approved by trusted authorities or standards.
This can be done by referencing lists provided by the Australian Cyber Security Centre (ACSC) to ensure that the switches meet security standards.
Procurement staff should buy only verified switches: Always purchase peripheral switches from reputable suppliers who provide devices with verified security credentials.
Make sure to check for compliance certificates or endorsements from official cyber security bodies.
System administrators should configure the switches properly: Set up the switches so they only allow necessary connections and block any unauthorised access.
They should follow setup instructions from the manufacturer alongside security guidelines from the ACSC.
Train employees on proper use: Office managers should organise training sessions for staff on how to correctly use the peripheral switches, highlighting the importance of maintaining the security settings and why it's risky to switch devices without approval.
Conduct regular security reviews: The IT security team should routinely check that all peripheral switches in use are still compliant with the latest security updates and guidelines.
This involves reviewing logs and testing connections to ensure no unintended data pathways exist.
Keep it running
Regularly verify any peripheral switch used for shared devices is evaluated/approved, and replace non-evaluated units to prevent cross-domain data transfer.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The approved equipment list: Request documentation listing all peripheral switches in use.
Look at
The list for details such as the make and model of each switch and evidence of approval from the ACSC.
Good evidence
Will show only switches that have been verified and no use of non-compliant models.
- Check 2 of 5What an auditor asks for
Ask for
To see the procurement records: Request records or receipts of purchasing transactions for peripheral switches.
Look at
These records to ensure purchases only from authorised suppliers and check for any compliance certificates included.
Good evidence
Displays complete documentation showing compliance checks.
- Check 3 of 5What an auditor asks for
Ask for
Configuration settings: Request current configuration files for installed peripheral switches.
Look at
Compliance with security standards set by the ACSC that restrict data flow between systems.
Good evidence
Shows secure setups with no unauthorised pathways.
- Check 4 of 5What an auditor asks for
Ask for
Training logs: Request the training schedule and attendance records for sessions on secure switch usage.
Look at
Recent training dates and high participation rates among relevant staff.
Good evidence
Provides thorough training records with feedback collected from participants.
- Check 5 of 5What an auditor asks for
Ask for
Recent security review reports: Request the latest reports on security assessments of peripheral switches.
Look at
Those reports for identified risks and actions taken to mitigate them.
Good evidence
Includes a documented assessment and resolution of any found issues.
Mappings
Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control covers in full and more.
ISO/IEC 27001: 2 mappings
This control is broader than A.8.1.
ISM-0591 requires organisations to use evaluated peripheral switches when sharing peripherals between systems to prevent security breaches through shared devices. This relates to Annex A 8.1 (Protection of user endpoint devices) as it is a specific endpoint-protection measure, while Annex A 8.1 covers a wider range of protections including device hardening.
This control partially meets A.8.12.
ISM-0591 specifies the use of evaluated peripheral switches to mitigate the risk of data leakage or unauthorized command execution across different systems. This supports Annex A 8.12 (Data leakage prevention measures) as it provides a technical solution to prevent unintended data transfer via shared peripherals.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.