ASD ISM 0813 Ensure secure access to critical infrastructure
What it says
Server rooms, communications rooms and security containers are not left in unsecured states.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMake sure rooms with servers and security equipment are always locked or secured.
This control is about making sure that rooms with important servers and security equipment are always locked or under control. It matters because if these rooms aren't secure, unauthorised people could tamper with equipment, steal data, or disrupt critical operations, causing financial and reputational harm.
Free. Save your status, tasks and notes.
Why it matters
Unlocked server rooms risk unauthorised access, leading to potential data breaches, equipment tampering, and operational disruptions.
How to implement
Facility Managers should check all server and equipment rooms are secured.
They can install reliable locks and access systems, such as passcodes or keycards, and make sure only authorised staff have access.
IT Teams need to monitor access to these rooms.
They should set up cameras and review footage regularly to spot any unauthorised entries.
Office Managers might conduct regular checks to confirm that locks and security cameras are working properly.
This means setting aside time each week to do a quick walk-through and note anything that seems unusual or broken.
Security Staff should log any visits to server rooms.
They can keep a sign-in sheet or digital log requiring staff to record every entry, making it easier to track who accessed the room and when.
Management should enforce security policies and provide training.
They need to ensure all staff understand the importance of securing these areas and the potential consequences of neglecting this duty.
Keep it running
Routinely verify server room/communications room doors and security containers are locked; review access logs and investigate anomalies promptly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Access logs to the server rooms: Request the record of who accessed the room, especially any physical logbooks or digital access logs.
Look at
Whether names, dates, and times are clearly documented.
Good evidence
Is a regularly updated log with restricted access entries and no suspicious activity.
- Check 2 of 5What an auditor asks for
Ask for
To see any training materials provided to staff: Request copies of any training and awareness materials given to employees regarding locking and securing equipment rooms.
Look at
Clear instructions on security protocols.
Good evidence
Includes detailed documents outlining best practices and protocols staff are expected to follow.
- Check 3 of 5What an auditor asks for
Ask for
About security incident reports: Request any reports regarding past security breaches or attempted unauthorised access.
Look at
Details about corrective actions taken.
Good evidence
Includes a report with analysis of incidents and documented follow-up actions to prevent recurrence.
- Check 4 of 5What an auditor asks for
Ask for
Maintenance records of physical security systems: Request records showing regular checks and maintenance of locks and surveillance systems.
Look at
Scheduled check frequencies and what repairs were needed.
Good evidence
Shows consistent maintenance logs with few significant repair needs or incidents.
- Check 5 of 5What an auditor asks for
Ask for
A security policy document: Request the document outlining the organisation's policy on physical security.
Look at
Clear guidelines on access control and response procedures.
Good evidence
Includes a comprehensive policy document with well-defined responsibilities and escalation procedures.
Mappings
Closest match in ISO/IEC 27001: A.7.3, Physical security for offices and facilities, which this control partially meets.
ISO/IEC 27001: 5 mappings
This control partially meets A.7.3.
Annex A 7.3 requires the design and implementation of physical security for offices, rooms and facilities to prevent unauthorised access. ISM-0813 supports that requirement by mandating that server rooms, communications rooms and security containers are not left unsecured, directly addressing operational discipline for securing critical physical areas. ISM-0813 is narrower because it focuses on specific rooms/containers and their secured state, whereas Annex A 7.3 covers the broader design and implementation of physical security across facilities.
This control partially meets A.7.5.
Annex A 7.5 requires organisations to design and implement protections against physical and environmental threats to infrastructure. ISM-0813 contributes to that outcome by requiring server rooms, communications rooms and security containers not be left unsecured, reducing exposure to intentional physical threats (e.g. theft, tampering). Annex A 7.5 is broader because it also encompasses environmental hazards (e.g. fire, flood) and other facility protections beyond 'not left unsecured'.
This control partially overlaps A.7.2.
Annex A 7.2 requires secure areas to be protected by appropriate entry controls and managed access points so only authorised people can enter. ISM-0813 relates by requiring server rooms, communications rooms, and security containers to not be left unsecured, which is a practical control to prevent opportunistic unauthorised entry. ISM-0813 is narrower and operational (secure-state/locking discipline) and does not by itself establish the full entry control regime (e.g. authorisation, visitor handling, access point design) expected under Annex A 7.2.
This control partially overlaps A.7.8.
Annex A 7.8 requires secure siting and physical protection of equipment to prevent unauthorised access or interference. ISM-0813 relates by requiring server rooms, communications rooms and security containers not to be left unsecured, which directly contributes to protecting equipment housed in those locations. ISM-0813 is specifically about maintaining secure states of protective enclosures, whereas Annex A 7.8 also includes considerations of where equipment is placed and protected from physical/environmental hazards.
This control depends on A.7.1.
Annex A 7.1 requires security perimeters to be defined and used to protect areas containing information and associated assets. ISM-0813 supports this by requiring server rooms, communications rooms and security containers not be left unsecured, which maintains the effectiveness of those areas' physical boundaries over time. Annex A 7.1 focuses on defining and applying perimeters, while ISM-0813 focuses on operational discipline to prevent perimeter breakdown through unsecured states.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.