ASD ISM 1543 Register for RF and IR devices in SECRET areas
What it says
An authorised RF and IR device register for SECRET and TOP SECRET areas is developed, implemented, maintained and regularly verified.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMaintain a register of RF and IR devices for secure areas to ensure authorised use.
Keeping a record of all RF (radio frequency) and IR (infrared) devices in secure areas helps ensure that only authorised devices are used. If this isn't done, unauthorised devices could be used to eavesdrop or steal sensitive information, potentially causing significant damage.
Free. Save your status, tasks and notes.
Why it matters
Lack of a device register could lead to unauthorised eavesdropping or data breaches, exposing sensitive information and causing potential harm.
How to implement
The security manager should create a register of authorised RF and IR devices.
Start by listing all devices currently in use in designated secret areas, including details like model, serial number, and owner.
IT staff should work with security personnel to update the device register regularly.
Set a routine schedule to check for new or removed devices, ensuring the register stays current and accurate.
Managers should inform staff about the importance of reporting new devices.
Use team meetings or emails to remind staff to report any new RF or IR devices intended for use in secure areas.
Procurement teams should coordinate with IT before buying new RF or IR devices.
They must ensure each device matches security requirements before it's added to the register.
Conduct routine training sessions to remind employees of the security protocols.
Security officers should explain the risks of unregistered devices and how to report them correctly.
Keep it running
Regularly review and update the RF and IR device register to ensure only authorised devices operate in secure areas, maintaining strong security posture.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the RF and IR device register: Verify it is up-to-date with details like device type, serial number, and owner name.
Look at
inclusion of recent entries and removals.
Good evidence
A detailed, current register showing all devices authorised for secure areas.
- Check 2 of 5What an auditor asks for
Look at
logs showing when and how often checks of the register occur.
Good evidence
Consistent records showing regular checks conducted on a monthly or quarterly basis.
- Check 3 of 5What an auditor asks for
Ask for
to see records of employee training on device reporting: Review attendance sheets or training materials.
Good evidence
Documented proof of regular training, with clear agendas and participant lists.
- Check 4 of 5What an auditor asks for
Ask for
to see procurement protocols for new devices: Check the procedure aligns with ensuring all devices are registered before introduction to secure areas.
Good evidence
Written procedure showing compatibility check and register update step.
- Check 5 of 5What an auditor asks for
Good evidence
Reports detailing handling of past incidents, showing effective resolution and updates to the register.
Mappings
Closest match in ISO/IEC 27001: A.5.9, Inventory management of information and associated assets, which this control covers in full and more.
ISO/IEC 27001: 1 mapping
This control is broader than A.5.9.
ISM-1543 requires an authorised RF and IR device register for SECRET and TOP SECRET areas to be developed, maintained, and regularly verified. Annex A 5.9 requires an organisation-wide inventory of information and associated assets (including ownership) to be developed and maintained, which can encompass RF/IR devices as a subset of assets. ISM-1543 is more specific in both asset type (RF/IR) and context (classified secure areas) and adds an explicit verification cadence requirement not stated in Annex A 5.9.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.