ASD ISM 0810 Secure facilities based on system classification
What it says
Classified systems are secured in facilities that meet the requirements for a security zone suitable for their classification.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure classified systems are in facilities suitable for their security needs.
This control ensures that systems with classified information are stored in secure environments that match their level of sensitivity. This is important because if these systems are in facilities that don't meet their security needs, sensitive data could be stolen or tampered with, leading to privacy breaches and potentially damaging the organisation's reputation.
Free. Save your status, tasks and notes.
Why it matters
Facilities that do not meet the required security zone for the system's classification can enable unauthorised physical access, leading to classified data compromise and reputational harm.
How to implement
Facilities Manager should assess each facility: Determine the security classification of systems housed in each location.
Evaluate if the facility meets the necessary security criteria for the system's classification level, such as physical barriers or surveillance.
IT Manager should coordinate with security personnel: Develop protocols that match the security requirements for classified systems in each facility.
Ensure that all access points have the appropriate locks or entry systems aligned with the system's classification.
Security Team should conduct regular inspections: Schedule inspections to check that the facilities remain compliant with necessary security standards.
If deficiencies are found, take immediate action to enhance physical security measures such as installing security cameras or alarm systems.
Operations Manager should train staff: Organise regular training sessions to educate staff about the importance of maintaining the security of classified systems.
Provide clear instructions on how to properly access these areas and reinforce the protocols that need to be followed.
Executive Team should review security policies: Regularly review and update facility security policies to align with current threats and regulatory requirements.
Ensure that any changes are swiftly communicated and implemented across the organisation.
Keep it running
Confirm the facility's security zone matches the system classification (e.g., barriers, access control, alarms, visitor controls) and revalidate after changes to location or classification.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The facility security plan: Request documentation detailing the security measures in place at each facility housing classified systems.
Look at
The security measures listed and confirm they match the classifications of the systems.
Good evidence
Is detailed documentation that aligns with the level of system classification.
- Check 2 of 5What an auditor asks for
Ask for
Access control logs: Request logs or records of who has accessed the facilities where classified systems are housed.
Look at
Regular entries that are authorised and evidence of denied access when appropriate.
Good evidence
Includes records demonstrating adherence to access protocols.
- Check 3 of 5What an auditor asks for
Ask for
Inspection reports: Request recent reports from internal or external facility inspections.
Look at
The findings and recommendations and ensure that corrective actions have been recorded and implemented.
Good evidence
Is a report demonstrating ongoing compliance and rectified issues.
- Check 4 of 5What an auditor asks for
Ask for
Training records: Request evidence of staff training sessions related to securing classified systems.
Look at
Attendance records and topics covered during the training.
Good evidence
Includes recent and relevant training records with high attendance and comprehensive content.
- Check 5 of 5What an auditor asks for
Ask for
Incident response records: Request logs of any security incidents related to facility access.
Look at
How incidents were identified, reported, and resolved.
Good evidence
Is a well-documented log showing prompt and effective responses to any breaches.
Mappings
Closest match in ISO/IEC 27001: A.7.1, Physical security perimeters, which this control partially meets.
ISO/IEC 27001: 6 mappings
This control partially meets A.7.1.
ISM-0810 requires that facilities hosting classified systems meet the requirements of an appropriate security zone for the classification. ISO/IEC 27001:2022 Annex A 7.1 requires defining and using physical security perimeters to protect areas containing information assets, which is a foundational method used to construct security zones. Annex A 7.1 is a general perimeter control and does not by itself ensure zone compliance for classified systems, whereas ISM-0810 is explicitly tied to classification-appropriate facility zoning.
This control partially meets A.7.2.
ISM-0810 requires classified systems to be hosted in facilities that meet the requirements for a security zone appropriate to their classification. ISO/IEC 27001:2022 Annex A 7.2 requires appropriate entry controls and access points to protect secure areas, which is a core feature of establishing and enforcing facility zoning. Annex A 7.2 is one type of physical control used within a zone model, while ISM-0810 is the overarching requirement to ensure the entire facility meets the relevant zone standard for classified systems.
This control partially meets A.7.3.
Annex A 7.3 requires physical security for offices, rooms and facilities to be designed and implemented. ISM-0810 applies that concept specifically by requiring classified systems to be secured in facilities meeting the security zone requirements suitable for their classification. ISM-0810 is narrower because it is limited to classified systems and classification-driven facility requirements, while Annex A 7.3 applies across organisational facilities more generally.
This control partially meets A.7.5.
ISM-0810 requires classified systems to be secured within facilities that meet security zone requirements suitable for the system's classification. ISO/IEC 27001:2022 Annex A 7.5 covers designing and implementing protections against physical and environmental threats to infrastructure, which is one component of making a facility suitable for higher-classification systems. Annex A 7.5 is broader and includes resilience to hazards and environmental events, while ISM-0810 focuses on the facility/zone suitability requirement for classified systems.
This control partially overlaps A.7.6.
Annex A 7.6 requires organisations to design and implement security measures for working in secure areas to protect sensitive activities and assets. ISM-0810 relates by mandating that classified systems are housed in facilities meeting a security zone appropriate to their classification, which underpins secure-area operations. ISM-0810 focuses on facility/zone requirements for systems, while Annex A 7.6 focuses on measures that control how work is conducted within those secure areas.
This control partially overlaps A.7.8.
Annex A 7.8 requires secure siting and protection of equipment to prevent physical compromise. ISM-0810 relates by mandating that classified systems are secured in facilities that meet the security zone requirements suitable for their classification, which is a direct way of ensuring protected siting. ISM-0810 is more prescriptive and classification-based at the facility level, whereas Annex A 7.8 is a general control not limited to classified systems.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.