ISM-1296policyASD Information Security Manual (ISM)

Protect Network Devices in Public Areas

Ensure network devices in public areas are secure from damage and unauthorised access.

Preventative NC OS PASD Information Security ManualGuidelines for physical security Physical entry CCTV and alarms Secure facilities

record_voice_over

Plain language

This control is about keeping network devices safe when they're in public places, like a lobby or shared office space. The idea is to prevent anyone from damaging them or accessing them without permission. If these devices aren't protected, someone might tamper with them, allowing access to important information or even disrupting the entire network.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

June 2022

Control Stack last updated

18 June 2026

E8 maturity levels

N/A

Guideline

Guidelines for physical security

Section

Facilities and systems

Topic

Physical Access to Network Devices in Public Areas

Official control statement

Physical security is implemented to protect network devices in public areas from physical damage or unauthorised access.

policyASD Information Security Manual (ISM)ISM-1296

priority_high

Why it matters

If network devices in public areas are not physically secured, they can be tampered with or stolen, causing outages and data compromise.

settings

Operational notes

Regularly inspect locks, cabinets and mounting for public-area network devices, and promptly repair damage to prevent tampering or unauthorised access.

02 - Implement

build

Implementation tips

Facilities management should secure network devices by physically mounting them. Use lockable cabinets or enclosures to house routers and switches in public areas, making sure they are firmly attached to walls or secure surfaces.
IT staff should regularly check that security measures are intact. Schedule monthly inspections to ensure devices remain securely housed and that locks or other securing mechanisms have not been tampered with.
Office managers should limit physical access to network devices. Place devices in areas that are monitored by cameras or in areas only accessible to authorised personnel, such as locked rooms or behind reception desks with staff present.
The IT team should install surveillance cameras to monitor devices. Position cameras to clearly view all devices in public spaces, ensuring recordings are regularly reviewed and stored according to your organisation's security policy.
Procurement should purchase tamper-evident seals for devices. Apply seals to entry points on network devices to easily identify if someone has attempted to open or tamper with them.

03 - Audit

fact_check

Audit / evidence tips

AskInspection logs: Request monthly inspection reports from the IT teamGoodIs a log showing inspections occurred as planned, with any issues promptly addressed
AskCamera footage access: Request access to surveillance footage covering public network devicesGoodIncludes recent footage with clear resolution and documented storage routines
AskAccess records: Request logs of who has access to the areas where the devices are locatedGoodRecord shows only approved personnel have had access, with documented sign-ins or electronic access logs
AskRecords of security incidents: Request documentation of any security incidents involving network devices in public areasGoodDetails no incidents, or if incidents occurred, they were resolved with corrective measures taken
AskPurchase records of security equipment: Request documents relating to procurement of locks, cabinets, and surveillance systemsGoodShows purchased items have been installed as planned and are in use

04 - Mappings

link

Cross-framework mappings

How ISM-1296 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
layersPartially meets(2)expand_less
Annex A 7.3	ISM-1296 requires physical security to protect network devices located in public areas from physical damage or unauthorised access
Annex A 7.8	ISM-1296 requires physical security to protect network devices in public areas against tampering, theft, or damage
sync_altPartially overlaps(5)expand_less
Annex A 7.1	ISM-1296 requires physical security measures to protect network devices located in public areas from physical damage or unauthorised access
Annex A 7.2	ISM-1296 requires physical security to prevent unauthorised access to network devices in public areas and to reduce the likelihood of tam...
Annex A 7.5	ISM-1296 requires protecting network devices in public areas from physical damage and unauthorised access
Annex A 7.6	Annex A 7.6 concerns security within secure areas, not public spaces
Annex A 8.20	ISM-1296 requires physical protections for network devices in public areas to prevent physical damage or unauthorised physical access
handshakeSupports(2)expand_less
Annex A 7.4	ISM-1296 requires implementing physical security to protect network devices in public areas from unauthorised access and physical damage
Annex A 7.12	Annex A 7.12 requires cables carrying power or data to be protected from interception, interference, or damage