Skip to content
Communications systems
ASD ISMISM-1450

ASD ISM 1450 Restricting devices in TOP SECRET areas

What it says

Microphones (including headsets and USB handsets) and webcams are not used with non-TOP SECRET workstations in TOP SECRET areas.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Do not use microphones or webcams with non-Top Secret devices in Top Secret areas.

In areas where sensitive Top Secret information is handled, it's crucial not to use microphones or webcams from devices that aren't authorised for Top Secret work. This is important because these devices can unintentionally record or transmit classified discussions, potentially leading to information leaks that could harm national security.

Why it matters

Using microphones or webcams with non-TOP SECRET workstations in TOP SECRET areas can record classified audio/video and leak TOP SECRET information.

How to implement

  1. The security manager should create a policy that clearly states microphones and webcams are prohibited on non-Top Secret devices in Top Secret areas.

    They can do this by drafting a written policy and sharing it during staff meetings and in official communications to ensure everyone understands the rule.

  2. IT support personnel should regularly check work areas to ensure compliance with this control.

    They can do this by scheduling routine inspections where they verify that no unauthorised devices are connected to workstations in these high-security zones.

  3. Managers need to educate their teams about why this control is in place.

    They should organise training sessions or briefings where they explain the risks of using non-authorised devices and how such breaches might occur.

  4. The procurement officer should ensure that any devices purchased for use in Top Secret areas are compliant with security guidelines.

    They can do this by consulting with the security manager to understand the specifications needed for safe device use.

  5. HR departments should include this control in the company's onboarding process.

    They can incorporate a checklist that new employees must review and sign, acknowledging their understanding and agreement to adhere to security policies regarding device use.

Keep it running

Audit TOP SECRET areas for microphones/webcams on non-TOP SECRET workstations; remove unauthorised devices and document any exceptions and approvals.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The security policy documentation: Request to see the specific policies that prohibit the use of microphones and webcams on non-Top Secret devices in Top Secret areas.

    Look at

    The document for a clear statement of the rule and its dissemination date.

    Good evidence

    Is a policy document that is current, clearly communicated, and acknowledged by staff.

  2. Check 2 of 5What an auditor asks for

    Look at

    Documented dates and findings of these inspections.

    Good evidence

    Is a record showing consistent checks with no recent violations reported.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Training attendance logs: Request logs or records showing who attended training or informational sessions on this control.

    Look at

    The logs for attendance dates, names of participants, and topics covered.

    Good evidence

    Shows regular training with comprehensive coverage of relevant security topics.

  4. Check 4 of 5What an auditor asks for

    Ask for

    To see the checklist used by procurement when purchasing devices for Top Secret areas.

    Look at

    Security approval markings and consideration of compliance with security policies.

    Good evidence

    Shows compliance checks are standard practice in procurement.

  5. Check 5 of 5What an auditor asks for

    Ask for

    The documents used in onboarding new employees concerning device use.

    Look at

    The content for clarity on the rules about device restrictions in sensitive areas.

    Good evidence

    Includes signed acknowledgements from each new employee indicating their understanding of these policies.

Mappings

Closest match in ISO/IEC 27001: A.7.6, Security measures for working in secure areas, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.7.6Security measures for working in secure areasPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.