ASD ISM 1645 Maintain and verify floor plan diagrams
What it says
Floor plan diagrams are developed, implemented, maintained and regularly verified.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRegularly update and review floor plans to ensure they are accurate and current.
This control is about keeping an accurate map of your physical workspace, especially where all the cables and tech equipment are. If you don't, you could end up wasting money and time fixing stuff that's not where you think it is.
Free. Save your status, tasks and notes.
Why it matters
Inaccurate floor plans can lead to delays and increased costs for maintenance and expansions, negatively affecting daily operations.
How to implement
Designate a facility manager: This person should oversee the creation and maintenance of accurate floor plan diagrams, focusing on areas that include cabling and communication infrastructure.
They should gather input from IT and building maintenance teams.
Have the IT team conduct regular checks: The IT team should periodically walk through the office to check that the physical layout matches the floor plans, particularly focusing on the location of network and communication equipment.
Schedule regular updates: Set monthly or quarterly times to review and update diagrams, especially after any changes such as office renovations or new cabling installations.
Involve your security team: The security team should verify that diagrams include sensitive areas, like server rooms, to ensure they are accurately represented for security planning.
Keep digital backups: Store floor plan diagrams digitally, so they are easily accessible and can be updated and shared without hassle.
Use a shared drive or cloud service for easy access.
Keep it running
Regular communication between IT and facilities teams is essential to ensure floor plans remain up-to-date and accurately reflect the current infrastructure.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the latest floor plan diagrams: Request the most recent versions of the floor plans, including cabling and equipment locations.
Look at
dated markings to indicate recent updates.
Good evidence
indicates a very recent revision date and clear detailing.
- Check 2 of 5What an auditor asks for
Ask for
records of past updates to the floor plans over the last year.
Look at
how often updates occur and the reasons for changes.
Good evidence
log shows regular updates and clear reasons, like renovations or new equipment.
- Check 3 of 5What an auditor asks for
Ask for
where digital copies of floor plans are stored and safeguarded.
Look at
secure access controls to these digital resources.
Good evidence
setup includes password-protected systems or encrypted storage.
- Check 4 of 5What an auditor asks for
Ask for
who is responsible for maintaining the floor plans. Ensure there is a clear point of contact and documentation of their role.
Good evidence
shows a designated role with specific responsibilities.
- Check 5 of 5What an auditor asks for
Ask for
physical space review reports: Ask to see reports from recent physical walkthrough checks of the space.
Look at
correspondence with the diagram updates.
Good evidence
report links directly to changes made in diagrams.
Mappings
Closest match in ISO/IEC 27001: A.7.5, Protecting against physical and environmental threats, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.7.5.
ISM-1645 requires organisations to develop, maintain, and regularly verify floor plan diagrams to ensure the diagrams accurately represent the environment. This supports Annex A 7.5 by ensuring the organisation has current layout information needed to design and validate protections against physical and environmental threats (e.g., fire exits, flood-prone areas, secured plant rooms, and critical infrastructure locations). Annex A 7.5 is broader because it mandates implementing threat protections, while ISM-1645 is about keeping the underlying facility documentation current and verified.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.