ASD ISM 1296 Protect network devices in public areas
What it says
Physical security is implemented to protect network devices in public areas from physical damage or unauthorised access.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure network devices in public areas are secure from damage and unauthorised access.
This control is about keeping network devices safe when they're in public places, like a lobby or shared office space. The idea is to prevent anyone from damaging them or accessing them without permission. If these devices aren't protected, someone might tamper with them, allowing access to important information or even disrupting the entire network.
Free. Save your status, tasks and notes.
Why it matters
If network devices in public areas are not physically secured, they can be tampered with or stolen, causing outages and data compromise.
How to implement
Facilities management should secure network devices by physically mounting them.
Use lockable cabinets or enclosures to house routers and switches in public areas, making sure they are firmly attached to walls or secure surfaces.
IT staff should regularly check that security measures are intact.
Schedule monthly inspections to ensure devices remain securely housed and that locks or other securing mechanisms have not been tampered with.
Office managers should limit physical access to network devices.
Place devices in areas that are monitored by cameras or in areas only accessible to authorised personnel, such as locked rooms or behind reception desks with staff present.
The IT team should install surveillance cameras to monitor devices.
Position cameras to clearly view all devices in public spaces, ensuring recordings are regularly reviewed and stored according to your organisation's security policy.
Procurement should purchase tamper-evident seals for devices.
Apply seals to entry points on network devices to easily identify if someone has attempted to open or tamper with them.
Keep it running
Regularly inspect locks, cabinets and mounting for public-area network devices, and promptly repair damage to prevent tampering or unauthorised access.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Inspection logs: Request monthly inspection reports from the IT team.
Look at
Dates, any issues noted, and resolution actions.
Good evidence
Is a log showing inspections occurred as planned, with any issues promptly addressed.
- Check 2 of 5What an auditor asks for
Ask for
Camera footage access: Request access to surveillance footage covering public network devices.
Look at
The quality and coverage of the footage and retention schedule.
Good evidence
Includes recent footage with clear resolution and documented storage routines.
- Check 3 of 5What an auditor asks for
Ask for
Access records: Request logs of who has access to the areas where the devices are located.
Look at
Entries that demonstrate limited and controlled access.
Good evidence
Record shows only approved personnel have had access, with documented sign-ins or electronic access logs.
- Check 4 of 5What an auditor asks for
Ask for
Records of security incidents: Request documentation of any security incidents involving network devices in public areas.
Look at
Incident details, how each was addressed, and follow-up actions.
Good evidence
Details no incidents, or if incidents occurred, they were resolved with corrective measures taken.
- Check 5 of 5What an auditor asks for
Ask for
Purchase records of security equipment: Request documents relating to procurement of locks, cabinets, and surveillance systems.
Look at
Descriptions of equipment bought and how it has been deployed.
Good evidence
Shows purchased items have been installed as planned and are in use.
Mappings
Closest match in ISO/IEC 27001: A.7.3, Physical security for offices and facilities, which this control partially meets.
ISO/IEC 27001: 7 mappings
This control partially meets A.7.3.
ISM-1296 requires physical security to protect network devices located in public areas from physical damage or unauthorised access. ISO/IEC 27001:2022 Annex A 7.3 requires physical security for offices, rooms and facilities to be designed and implemented, which includes controlling and securing areas where network devices may be placed. Annex A 7.3 is broader because it covers facilities generally, while ISM-1296 is a specific application focused on network devices in publicly accessible locations.
This control partially meets A.7.8.
ISM-1296 requires physical security to protect network devices in public areas against tampering, theft, or damage. ISO/IEC 27001:2022 Annex A 7.8 requires equipment to be securely sited and protected, which directly includes securing network devices placed in publicly accessible areas. Annex A 7.8 is broader because it applies to all equipment and locations, whereas ISM-1296 targets the specific risk context of public areas.
This control partially overlaps A.7.1.
ISM-1296 requires physical security measures to protect network devices located in public areas from physical damage or unauthorised access. ISO/IEC 27001:2022 Annex A 7.1 requires defining and using physical security perimeters to protect areas containing information and associated assets, which can include perimeters around comms cupboards, kiosks, or public-facing device locations. They overlap where perimeters are used to reduce unauthorised physical access to network equipment, but Annex A 7.1 focuses on area boundary design while ISM-1296 is specifically about safeguarding the devices themselves in public areas (e.g., enclosures, mounting, locking).
This control partially overlaps A.7.2.
ISM-1296 requires physical security to prevent unauthorised access to network devices in public areas and to reduce the likelihood of tampering or theft. ISO/IEC 27001:2022 Annex A 7.2 requires appropriate entry controls for secure areas, which can be used to restrict access to communications rooms, cabinets, or other spaces housing network devices. They overlap where access controls (locks, badges, controlled doors) are the method used to protect publicly adjacent network equipment, but ISM-1296 can also be met through device-level protections even when an area cannot be made a 'secure area'.
This control partially overlaps A.7.5.
ISM-1296 requires protecting network devices in public areas from physical damage and unauthorised access. ISO/IEC 27001:2022 Annex A 7.5 requires protection against physical and environmental threats to infrastructure, including intentional and unintentional physical threats. They overlap in mitigating physical damage risks to exposed network devices (e.g., impact, vandalism), but Annex A 7.5 also covers wider environmental and disaster scenarios, while ISM-1296 additionally emphasises preventing unauthorised physical access/tampering in public spaces.
This control partially overlaps A.7.6.
Annex A 7.6 concerns security within secure areas, not public spaces. ISM-1296's focus on public area devices does not align sufficiently with this specific secure-area requirement.
This control partially overlaps A.8.20.
ISM-1296 requires physical protections for network devices in public areas to prevent physical damage or unauthorised physical access. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled to protect information, typically focusing on technical and operational security (configuration, management, segmentation, monitoring). They overlap where physical tamper-resistance and prevention of unauthorised physical access are part of an overall network device security posture, but Annex A 8.20 extends well beyond physical security into technical controls that ISM-1296 does not address.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.