ASD ISM 1053 Secure physical access for classified equipment
What it says
Classified servers, network devices and cryptographic equipment are secured in server rooms or communications rooms that meet the requirements for a security zone suitable for their classification.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure physical security for critical equipment based on its classification.
This guideline ensures that crucial pieces of technology, like servers and devices used for secure communications, are kept in secure rooms suited to their importance. If this isn't done, there's a risk of unauthorised people physically accessing these devices, potentially leading to theft, tampering, or disruption of services, which can result in the loss of sensitive information or harm to the organisation's operations.
Free. Save your status, tasks and notes.
Why it matters
Without secure, classified-rated server/comms rooms, classified servers and crypto gear may be accessed or removed, causing data compromise and service disruption.
How to implement
Facilities manager should ensure that rooms housing critical equipment meet security requirements by coordinating with a security consultant.
They can do this by inspecting current facilities to ensure locks, access controls, and monitoring systems such as CCTV are properly installed and operational.
The IT team should keep an updated inventory of all classified equipment locations.
This involves regularly verifying the presence and proper positioning of devices on site and maintaining a detailed log of any relocations or changes.
Security personnel should conduct routine checks to ensure only authorised personnel have access to secure areas.
This can be achieved by conducting unannounced spot checks and reviewing access logs regularly to identify any anomalies.
Management should establish a clear policy stating who can access classified equipment, ensuring staff understand the importance of these areas.
This could involve creating a document that lists authorised personnel and providing regular training sessions on access protocols.
Procurement teams should purchase security systems that meet Australian Government security standards.
They should evaluate suppliers based on their ability to provide systems that include features like robust access control, tamper alerts, and remote monitoring capabilities.
Keep it running
Ensure classified servers, network devices and crypto equipment stay within approved security zones; review room certification, access lists and entry logs when changes occur.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The security policy document covering physical access controls.
Look at
The list of requirements and procedures outlined for securing classified equipment.
Good evidence
Includes specific protocols matching the classification level and sign-off by the security manager.
- Check 2 of 5What an auditor asks for
Good evidence
Has logs that align with authorised user lists and no unexplained access instances.
- Check 3 of 5What an auditor asks for
Ask for
A recent security audit report of the classified equipment areas.
Look at
The sections detailing compliance with physical security requirements.
Good evidence
Shows no major findings or has documented corrective actions for issues found.
- Check 4 of 5What an auditor asks for
Look at
Attendance records and training content.
Good evidence
Includes records of recent, regular training sessions underscoring the importance of security protocols.
- Check 5 of 5What an auditor asks for
Good evidence
Shows consistent maintenance as per manufacturer and security policy guidelines.
Mappings
Closest match in ISO/IEC 27001: A.7.1, Physical security perimeters, which this control partially meets.
ISO/IEC 27001: 7 mappings
This control partially meets A.7.1.
ISM-1053 requires classified ICT and cryptographic equipment to be located in secure server/communications rooms that satisfy security zone requirements suitable to their classification. Annex A 7.1 requires defined physical security perimeters to protect areas containing information and associated assets, which would include establishing perimeters around secure rooms hosting classified equipment. ISM-1053 is a specific application of perimeter concepts to classified equipment locations, whereas Annex A 7.1 applies to any protected area.
This control partially meets A.7.3.
Annex A 7.3 requires physical security for offices, rooms and facilities to be designed and implemented to control physical access. ISM-1053 mandates that classified servers, network devices and cryptographic equipment are secured in server/communications rooms meeting security zone requirements suitable for their classification. ISM-1053 is narrower because it is specific to classified ICT equipment and prescribed secure room requirements, whereas Annex A 7.3 covers physical security across all office and facility areas.
This control partially overlaps A.7.2.
ISM-1053 requires classified servers, network devices and cryptographic equipment to be secured in server/communications rooms meeting the security zone requirements for their classification. Annex A 7.2 requires secure areas to be protected by appropriate entry controls and access points, which is a key mechanism for enforcing the security zone protections around those rooms. The overlap is in securing access to the rooms; however, ISM-1053 additionally requires the room/zone itself to meet classification-specific construction and zoning requirements beyond just entry controls.
This control partially overlaps A.7.4.
ISM-1053 requires classified servers, network devices and cryptographic equipment to be housed in secure rooms that meet security zone requirements aligned to classification. Annex A 7.4 requires continuous monitoring of premises for unauthorised physical access, which can be used to monitor access to those secure server/communications rooms (e.g., CCTV/alarms). The overlap is monitoring and detection for protected areas, but Annex A 7.4 is broader (whole premises) and ISM-1053 is focused on classification-appropriate secure zoning for specific equipment.
This control partially overlaps A.7.8.
Annex A 7.8 requires equipment to be sited securely and protected to reduce physical threats and unauthorised access. ISM-1053 relates by mandating that classified servers, network devices and cryptographic equipment be secured in server/communications rooms that meet an appropriate security zone standard for their classification. ISM-1053 is more prescriptive and classification-driven, while Annex A 7.8 applies more generally to equipment siting and protection regardless of classification.
This control depends on A.5.12.
ISM-1053 requires physical security measures (security zones for server/communications rooms) to be suitable for the classification of the equipment housed within them. Annex A 5.12 requires information to be classified according to confidentiality, integrity and availability needs, which determines what classification (and therefore what physical zone standard) should apply to the equipment and systems. Without the classification practices in Annex A 5.12, organisations cannot reliably determine what 'suitable for their classification' means for ISM-1053.
This control depends on A.7.5.
Annex A 7.5 requires organisations to protect infrastructure from physical and environmental threats through appropriate design and implementation. ISM-1053 supports this by requiring classified servers, network devices and cryptographic equipment to be secured in rooms that meet security zone requirements, which reduces physical compromise and provides a controlled environment for further environmental protections. Annex A 7.5 is broader as it explicitly encompasses environmental threat controls and applies across all infrastructure, not only classified equipment and zones.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.