ASD ISM 0829 Detect unauthorised RF devices in secure areas
What it says
Security measures are used to detect and respond to unauthorised RF devices in SECRET and TOP SECRET areas.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse security measures to find and handle unauthorised RF devices in secure zones.
This control is about making sure no one sneaks in devices that send or receive radio signals into secure areas, like places where top-secret information is kept. These unauthorised gadgets, if undetected, could be used to listen in on conversations or steal sensitive data, putting your organisation at serious risk.
Free. Save your status, tasks and notes.
Why it matters
If unauthorised RF devices are not detected in SECRET/TOP SECRET areas, they can capture or transmit sensitive communications, causing serious data compromise.
How to implement
Security team: Plan regular sweeps of secure areas for any unknown radio frequency devices.
Use handheld RF detectors to check for unexpected signals and cover all corners of the area for thoroughness.
Office manager: Brief all staff on the policy regarding RF devices in secure areas.
Hold a short session to explain why these rules matter and ensure everyone signs a form acknowledging their understanding.
IT team: Implement technology that can pick up and alert you to new or suspicious RF devices entering the area.
Set up alerts so your staff receives a notification if something unusual is detected.
Facilities team: Control the access points by ensuring doors to secure areas have electronic locks that can log entries.
Only allow access to those with a legitimate need and maintain an updated list of these individuals.
Procurement officer: Work with suppliers to ensure any equipment brought into secure areas is vetted and approved.
Create a checklist that confirms all devices meet security standards before they are allowed inside.
Keep it running
Use approved RF detection tools and perform scheduled and random sweeps in SECRET/TOP SECRET areas; tune baselines and investigate alerts promptly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The RF detection plan: Request the document or workflow detailing how often rooms are checked for RF devices.
Look at
Dates and signatures to verify that checks are conducted regularly.
Good evidence
A schedule with regular intervals and responsible persons indicated.
- Check 2 of 5What an auditor asks for
Ask for
To see training records: Request a log or record of staff training sessions on RF device policy.
Look at
Participant names, dates, and topics covered.
Good evidence
Signed attendance sheets showing participation and understanding.
- Check 3 of 5What an auditor asks for
Ask for
About detection technology: Request evidence of any technological tools used to detect RF devices.
Look at
Purchase orders or maintenance records.
Good evidence
Documentation of devices in use and logs of detected signals.
- Check 4 of 5What an auditor asks for
Ask for
Access logs: Request logs showing who entered the secure areas and when.
Look at
Time and date consistency and correlation with entry authorisation lists.
Good evidence
Logs with no unauthorised entries and consistent with staff authorisations.
- Check 5 of 5What an auditor asks for
Ask for
Equipment vetting records: Request the checklist or logs used when vetting equipment brought into secure areas.
Look at
Checklist completion and signatures.
Good evidence
Detailed logs showing each item vetted and approved before entry.
Mappings
Closest match in ISO/IEC 27001: A.7.1, Physical security perimeters, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.1.
Annex A 7.1 requires defined physical security perimeters to protect sensitive areas and assets from unauthorised access. ISM-0829 relates by mandating measures to detect and respond to unauthorised RF devices within SECRET and TOP SECRET areas, which is an enforcement mechanism supporting perimeter integrity for those zones. The ISO control is broader, as it covers all perimeter types and access threats, whereas ISM-0829 is limited to RF device detection/response in specific classified areas.
This control partially meets A.7.6.
ISM-0829 requires security measures to detect and respond to unauthorised RF devices in SECRET and TOP SECRET areas. Annex A 7.6 requires organisations to design and implement security measures for working in secure areas, which can include prohibiting, detecting and handling unauthorised electronic devices within those areas. ISM-0829 is a specific, RF-focused counter-surveillance requirement (detection plus response), while Annex A 7.6 is broader and leaves the choice of measures to the organisation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.