ASD ISM 1074 Controlling access to critical IT infrastructure
What it says
Keys or equivalent access mechanisms to server rooms, communications rooms and security containers are appropriately controlled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure keys to server and communication rooms are securely managed.
This control is about keeping the keys to important areas like server rooms secure so that only authorised people can access them. If we don't keep these keys safe, unauthorised people might enter these critical areas, potentially damaging equipment, stealing data, or causing service disruptions.
Free. Save your status, tasks and notes.
Why it matters
Poor control of access keys could allow unauthorised entry to critical infrastructure, leading to data theft, sabotage, or severe operational disruptions.
How to implement
The facility manager should implement a key logging system to track who takes keys and when.
This can be done by setting up a sign-in/sign-out sheet or using an electronic key management system to record these transactions.
The IT manager should assign a responsible person to oversee server room access.
They need to ensure that only authorised personnel are listed and given access, updating the list as roles change within the organisation.
HR should conduct regular training for staff on the importance of securing key access.
This involves setting up brief sessions to inform staff about why key control is critical and how misuse can impact the organisation.
Security personnel should perform regular checks to make sure keys are stored securely when not in use.
This involves routine inspections of the storage facility, ensuring it remains locked and only accessible to authorised staff.
The manager in charge of security should have a protocol for lost or misplaced keys.
This includes a prompt reporting mechanism, reviewing access logs, and changing locks or updating access mechanisms if a key is compromised.
Keep it running
Audit server room and comms room key registers regularly; revoke access for leavers and investigate missing keys immediately.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The current list of authorised personnel with access to server and communication rooms.
Look at
The names and roles listed to ensure only those with a legitimate need have access.
Good evidence
Is a current, dated list with justified access for each person.
- Check 2 of 5What an auditor asks for
Ask for
Records of key issuance and returns.
Look at
How they track these transactions, checking for inconsistencies or missing entries.
Good evidence
Is a comprehensive log with names, dates, and times of when keys were issued and returned.
- Check 3 of 5What an auditor asks for
Ask for
To see the training records on key management for staff.
Look at
The attendee lists and the content covered in training sessions.
Good evidence
Program will have regular sessions (at least annually) and show that all relevant staff were trained.
- Check 4 of 5What an auditor asks for
Ask for
Security inspection reports for the storage location of the keys.
Look at
Whether regular checks are documented and any issues are promptly addressed.
Good evidence
Is dated inspection logs with follow-up actions noted for any issues found.
- Check 5 of 5What an auditor asks for
Ask for
About the procedure for handling lost keys.
Look at
The documented process to ensure it covers incident reporting and subsequent actions.
Good evidence
Procedure will show prompt steps taken, with a risk assessment and mitigation plan documented.
Mappings
Closest match in ISO/IEC 27001: A.7.1, Physical security perimeters, which this control covers in full and more.
ISO/IEC 27001: 4 mappings
This control is broader than A.7.1.
ISM-1074 requires keys or equivalent access mechanisms to server rooms, communications rooms and security containers to be appropriately controlled. ISO/IEC 27001:2022 Annex A 7.1 requires security perimeters to be defined and used to protect areas containing information and associated assets, which commonly includes server/communications rooms. Annex A 7.1 is broader because it covers perimeter definition and physical boundary protections, whereas ISM-1074 focuses specifically on controlling the mechanisms (keys/equivalents) used to cross those boundaries.
This control partially meets A.7.5.
Annex A 7.5 requires safeguards that protect infrastructure from physical threats and environmental events. ISM-1074 is a specific physical security measure that controls keys or equivalent access mechanisms to critical rooms and containers, reducing the likelihood of unauthorised physical access and interference. Annex A 7.5 is wider in scope because it also expects design/implementation of controls for environmental threats and resilience measures, not just key control.
This control partially overlaps A.7.2.
Annex A 7.2 requires organisations to protect secure areas through controlled entry and access points. ISM-1074 directly relates by mandating that keys or equivalent access mechanisms to server rooms, communications rooms, and security containers are appropriately controlled, which is a core method of enforcing authorised entry. ISM-1074 focuses on controlling the credential/mechanism (keys, badges, etc.) rather than the broader secure-area entry control design and processes covered by Annex A 7.2.
This control partially overlaps A.7.8.
Annex A 7.8 requires equipment to be positioned and protected to reduce unauthorised access and physical harm. ISM-1074 specifically controls physical access mechanisms (keys/equivalents) to server rooms, communications rooms and security containers that house critical IT infrastructure, directly supporting secure placement and protection of that equipment. ISM-1074 is about access governance, while Annex A 7.8 also covers non-access siting protections (e.g. environmental placement and physical safeguards).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.