ASD ISM 1461 Same classification and security domain for shared isolation hosts
What it says
When using a software-based isolation mechanism that consumes shared physical computing resources for SECRET or TOP SECRET operating environments, the physical server and all operating environments are of the same classification and belong to the same security domain.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWhen software isolation shares one physical server for SECRET or TOP SECRET work, the server and every environment on it must be the same classification and security domain.
Some servers use software (called a hypervisor) to run several separate "virtual" computers on a single physical machine, all sharing the same hardware. This control says that if you do this for highly sensitive work classified as SECRET or TOP SECRET, then the physical server and every virtual environment running on it must all carry the same classification and belong to the same security domain (a group of systems trusted to handle the same level of information). In plain terms, you must not mix different sensitivity levels on the one shared machine, because software separation alone is not strong enough to keep top-secret information safe from less-trusted neighbours sharing the same hardware.
Free. Save your status, tasks and notes.
Why it matters
Mixing different classifications or security domains on one shared physical server can let highly sensitive SECRET or TOP SECRET information leak to less-trusted environments through shared hardware.
How to implement
The IT or infrastructure team should keep a register that lists each physical server using software-based isolation, recording its classification and security domain so it is clear no SECRET or TOP SECRET host is shared with anything of a different level.
System administrators should configure virtualisation hosts so that only operating environments of the identical classification and security domain can be created or migrated onto a given physical server, blocking mixed-level placement at the configuration stage.
The team setting up SECRET or TOP SECRET systems should label each physical server and every virtual environment on it with its classification, and verify all labels match before the server is put into use.
Change managers should add a check to the approval process so that any request to add a new virtual environment to a shared SECRET or TOP SECRET host is rejected unless it has the same classification and security domain.
The security or governance lead should arrange periodic reviews of shared SECRET and TOP SECRET hosts to confirm no lower-classification or different-domain environment has been added over time.
Keep it running
Re-check shared SECRET and TOP SECRET hosts whenever environments are added, moved or rebuilt, since software-based isolation alone does not justify mixing classifications or security domains.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the inventory of physical servers that use software-based isolation for SECRET or TOP SECRET work.
Look at
whether each entry records the classification and security domain of the host and every environment on it.
Good evidence
is a complete, current register showing all match on each shared host.
- Check 2 of 5What an auditor asks for
Ask for
how the organisation prevents environments of different classifications from sharing one physical server.
Look at
the virtualisation host configuration and placement rules.
Good evidence
shows technical controls that stop mixed-level environments being placed together, not just a written policy.
- Check 3 of 5What an auditor asks for
Ask for
to see the classification labels for a sample SECRET or TOP SECRET shared server and its virtual environments.
Look at
whether the physical host label matches every operating environment running on it.
Good evidence
is consistent labelling with no mismatches.
- Check 4 of 5What an auditor asks for
Ask for
the change-control records covering additions of new virtual environments to shared high-classification hosts.
Look at
whether each approval confirmed matching classification and security domain.
Good evidence
shows approvals explicitly verified this before deployment.
- Check 5 of 5What an auditor asks for
Ask for
the most recent review of shared SECRET and TOP SECRET hosts.
Look at
the findings and any corrective actions.
Good evidence
is a dated review confirming all environments on each host share the same classification and domain, with issues tracked to closure.
Mappings
Closest match in ISO/IEC 27001: A.5.12, Information classification policy and practices, which this control depends on.
ISO/IEC 27001: 1 mapping
This control depends on A.5.12.
ISM-1461 requires that when virtualisation is used to share a physical server for SECRET or TOP SECRET computing environments, the host and all guests must be the same classification and within the same security domain. ISO/IEC 27001:2022 Annex A 5.12 is a prerequisite because the organisation must have an information classification policy and practices to determine what is treated as SECRET/TOP SECRET (or equivalent) and therefore what workloads must not be co-hosted across differing classifications/domains. Annex A 5.12 does not impose any virtualisation or co-tenancy restriction itself, but it provides the classification basis needed to apply ISM-1461 consistently.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.