ASD ISM 1338 Use lower-powered wireless access points for coverage
What it says
Instead of deploying a small number of wireless access points that broadcast on high power, a greater number of wireless access points that use less broadcast power are deployed to achieve the desired footprint for wireless networks.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDeploy many low-power wireless access points to cover an area instead of few high-power ones.
This control is about using many small wireless devices with lower power instead of just a few big ones to cover a building with Wi-Fi. It matters because using fewer, high-powered devices can lead to signal overlap, causing interference and making your network less secure and efficient. With smaller, low-power devices, you have better control over where the Wi-Fi goes, making it harder for unwanted people outside your building to access your network.
Free. Save your status, tasks and notes.
Why it matters
Without using more low-power access points, wireless coverage can extend beyond premises, increasing risk of unauthorised access and data breaches.
How to implement
The IT team should map out the areas where Wi-Fi is needed.
They should walk through the building to determine which rooms and spaces need coverage and note any physical barriers that might affect signal strength.
The procurement team should buy multiple low-powered access point devices.
This means checking the technical specifications to ensure they can be set to lower broadcasting power and making sure they have enough devices to cover all the identified areas.
The IT team should install the access points strategically around the building.
They should place them to ensure there's no overlap between their coverage areas and adjust the power settings to cover just the necessary areas.
The IT team should test the network coverage once installed.
They should walk through the areas with a device connected to Wi-Fi to check for blind spots and adjust the position or power of access points if needed.
The office manager should regularly check Wi-Fi performance feedback from staff.
They should gather input on any issues with network connectivity and pass these to the IT team for troubleshooting and improvement.
Keep it running
Review access point placement and transmit power so coverage meets the required footprint without leaking outside the premises; retune channels after layout changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network layout and equipment list: Request the documents that show where each low-powered access point is installed and the data on their power settings.
Look at
A map or diagram plus a list of device specifications.
Good evidence
Is a well-labelled network map with clear positioning and power levels listed for each unit.
- Check 2 of 5What an auditor asks for
Ask for
To see the Wi-Fi coverage test results: Request records from when the IT team tested the coverage of Wi-Fi after installation.
Look at
Detailed notes on any signal weak spots or interference issues found.
Good evidence
Shows areas were tested, identifies issues, and notes corrective actions taken.
- Check 3 of 5What an auditor asks for
Ask for
A maintenance schedule and logs: Request the document showing when Wi-Fi performance has been reviewed or adjusted.
Look at
Dates, results of checks, and any adjustments made.
Good evidence
Includes regular reviews with documented findings and updates.
- Check 4 of 5What an auditor asks for
Ask for
About staff feedback records: Request evidence of how staff feedback on Wi-Fi performance is gathered and addressed.
Look at
Surveys, emails, or meeting notes.
Good evidence
Shows systematic collection of feedback and logs corrective actions taken.
- Check 5 of 5What an auditor asks for
Ask for
To see security reports on unauthorised attempts to access the network: Request logs or summaries of detected attempts from outside the building.
Look at
Details on how such data is gathered and analysed.
Good evidence
Is a clear process showing how network boundaries are monitored and secured.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.20.
ISM-1338 requires organisations to engineer Wi-Fi coverage using a greater number of lower-powered wireless access points rather than fewer high-powered ones, to constrain the wireless footprint. This relates to Annex A 8.20 because securing and controlling networks and network devices includes secure configuration and design choices for wireless infrastructure (e.g., access point placement and transmit power) to reduce exposure outside controlled areas. Annex A 8.20 is broader (covering all networks/devices and their management), while ISM-1338 is a specific wireless design technique within that broader expectation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.