ASD ISM 1530 Secure classified equipment in suitable security containers
What it says
Classified servers, network devices and cryptographic equipment are secured in security containers suitable for their classification taking into account the combination of security zones they reside in.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeep classified IT equipment in secure containers based on their classification and location's security zone.
This control is about keeping sensitive IT equipment, like servers and network devices, safe from unauthorised access by storing them in secure containers. It matters because if these items are not properly protected, someone could tamper with them, leading to data breaches, loss of sensitive information, or disruptions to business operations.
Free. Save your status, tasks and notes.
Why it matters
If classified servers, network devices or crypto gear aren't stored in suitable security containers, they can be accessed or tampered with, causing classified data compromise and service disruption.
How to implement
Business owners should work with an IT consultant to identify which IT equipment is classified and where it should be stored securely.
The consultant can help create a list of all classified equipment and assess the current storage situation.
Facilities managers should arrange to acquire the right security containers for equipment storage.
This could involve researching suppliers who offer security-rated safes or cabinets and ensuring they match the security classification needed.
IT teams should ensure the secure containers are installed correctly.
This means verifying that the containers are placed in the right location and are properly anchored, if necessary, to prevent easy removal.
Office managers should maintain a log of who has access to the secure containers and conduct regular checks.
This involves creating a sign-out sheet and regularly cross-referencing it with recorded access times.
Security personnel should conduct regular audits of the storage containers to ensure they remain compliant with the security classification requirements.
This involves physically inspecting the containers for any signs of tampering and verifying that all seals and locks are intact.
Keep it running
Regularly inspect security containers for tampering, confirm locks/alarms work, and verify containers are rated suitable for the equipment's classification and zone combination.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The inventory list of classified equipment: Request a detailed list of all servers and devices that are considered classified.
Look at
A comprehensive and up-to-date inventory with classifications noted.
Good evidence
A list that matches the number of items stored securely and accurately noted classifications.
- Check 2 of 5What an auditor asks for
Ask for
To see the procurement records for security containers: Request receipts or orders for containers that match the classification rating required.
Look at
The specifications on the purchase documents.
Good evidence
Documents showing purchase of appropriately rated containers for the relevant equipment.
- Check 3 of 5What an auditor asks for
Ask for
Access logs to secure containers: Request to see the logbook or electronic records of access attempts.
Look at
Logs that show who accessed the storage, when, and for what purpose.
Good evidence
Consistently filled records with correct details and no unauthorised access noted.
- Check 4 of 5What an auditor asks for
Ask for
To see the security inspection reports: Request the most recent checklists or reports from inspections of the containers.
Look at
Notes indicating compliance and any corrective actions taken.
Good evidence
Up-to-date inspection reports with no outstanding issues and signed off by a responsible officer.
- Check 5 of 5What an auditor asks for
Ask for
About security policy documentation: Request a copy of the policy governing secure storage.
Look at
Clear guidelines on what equipment should be stored in secure containers and the process for doing so.
Good evidence
Detailed instructions tailored to the organisation's needs and recently reviewed.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
ISM-1530 requires classified servers, network devices and cryptographic equipment to be physically secured in security containers appropriate to their classification and the security zones they are located within. ISO/IEC 27001:2022 Annex A 5.15 requires the organisation to establish and implement rules for controlling both physical and logical access to information and associated assets. ISM-1530 is a specific physical protection mechanism that sits within the broader access control policy and procedures expected by Annex A 5.15.
This control depends on A.5.12.
ISM-1530 requires organisations to select security containers suitable for the classification of the equipment and the security zones in which it resides. ISO/IEC 27001:2022 Annex A 5.12 requires information to be classified according to the organisation's security needs. In practice, implementing ISM-1530 depends on having a classification scheme (Annex A 5.12) so the organisation can determine what container rating and controls are appropriate, but Annex A 5.12 does not itself require physical containerisation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.