ASD ISM 1480 Ensure high assurance for peripheral switches
What it says
Evaluated peripheral switches used for sharing peripherals between SECRET or TOP SECRET systems and any non-SECRET or TOP SECRET systems complete a high assurance evaluation.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPeripheral switches used between classified and unclassified systems must undergo a thorough security evaluation.
If you have devices that switch connections between highly classified and regular computer systems, it's crucial they undergo a thorough security check. This is to prevent sensitive information from slipping through the cracks and ending up where it shouldn't be.
Free. Save your status, tasks and notes.
Why it matters
Failing to ensure high assurance for peripheral switches risks data leaks, where classified information may inadvertently transfer to less secure systems.
How to implement
The IT manager should first identify all peripheral switches currently used between classified and non-classified systems.
Make a list of these switches and where they are used within the organisation.
Procurement should ensure that any new peripheral switches purchased meet high-assurance security standards.
Work with verified suppliers and check for certifications that meet local security regulations.
System owners should organise a high-assurance security evaluation for each switch used in classified environments.
This might mean scheduling an appointment with an external security consultant specialised in this field.
The IT team should document the results of the security evaluations for peripheral switches.
Keep a detailed report of findings and any actions taken to address security weaknesses.
Management should regularly schedule reviews of the security status of these switches, ensuring that no outdated or unassessed hardware remains in use.
Set up a calendar reminder for these check-ins and involve the cyber security officer in each review.
Keep it running
Maintain evidence the peripheral switch has passed a high assurance evaluation for SECRET/TOP SECRET sharing; replace any unevaluated model.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of all peripheral switches currently in use: This should include details of their usage in classified and unclassified systems.
Look at
Whether each switch has been clearly identified and mapped to its use.
Good evidence
A comprehensive list with each switch's installation date and current operational status.
- Check 2 of 5What an auditor asks for
Look at
The thoroughness of the report and note any action items that have been addressed.
Good evidence
A well-documented report with clear findings and mitigation steps completed.
- Check 3 of 5What an auditor asks for
Ask for
To see procurement records for these switches: Ensure they include proof of purchase from authorised suppliers who meet security standards.
Look at
Vendor details and certifications provided.
Good evidence
Verified procurement processes with a clear chain of custody showing certified equipment was acquired.
- Check 4 of 5What an auditor asks for
Look at
The frequency of reviews and minutes from meetings held.
Good evidence
Scheduled reviews with documented outcomes and plans for the next checks.
- Check 5 of 5What an auditor asks for
Ask for
To see evidence of actions taken after evaluations: Ensure there is documentation on how vulnerabilities are mitigated or addressed.
Look at
The documented follow-up actions or changes made.
Good evidence
All vulnerabilities had corresponding actions with proof they have been completed or are in progress.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control depends on.
ISO/IEC 27001: 1 mapping
This control depends on A.5.19.
ISM-1480 requires evaluated peripheral switches that bridge SECRET/TOP SECRET and lower classifications to undergo a high assurance evaluation. Annex A 5.19 supports this by requiring the organisation to manage supplier/product security risk, ensuring the selected peripheral switch has appropriate independent assurance (e.g., certified evaluation) and trustworthy supply chain. However, Annex A 5.19 is broader across all supplier relationships and does not specifically mandate high assurance evaluation for cross-domain peripheral switches like ISM-1480 does.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.