ASD ISM 1884 Ensure compliance with emanation security doctrine
What it says
Emanation security doctrine produced by ASD for the management of emanation security matters is complied with.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOrganisations must follow guidelines for managing information leaks through electromagnetic emissions.
This control is all about preventing leaks of sensitive information through electromagnetic waves, like those that come from electronic devices. If we ignore this, hackers could intercept these signals and access private data, risking the security of our entire organisation.
Free. Save your status, tasks and notes.
Why it matters
Without emanation security controls, electromagnetic emissions may be exploited to recover sensitive information, enabling espionage and serious data compromise.
How to implement
The IT manager should ensure all staff are aware of the potential risk of electromagnetic leaks by organising regular training sessions.
In these sessions, explain how electronic devices can unintentionally emit signals and what can be done to minimise these emissions.
IT staff should conduct regular scans of the organisation's offices to check for any abnormal electromagnetic emissions.
Use specialised equipment to detect any unusual signals that might leak sensitive data.
Facilities managers should check that all new office devices meet recommended standards to prevent electromagnetic leaks.
They can achieve this by following guidelines from Australian Signals Directorate (ASD) during purchase and installation processes.
Management should ensure that sensitive work areas have additional protections.
This might include creating designated zones where only pre-approved, low-emission equipment is used and installed, reducing the chance of leaks.
The security team should routinely update policies on device use and storage, incorporating ASD's emanation security guidelines.
Make sure all staff are informed of these policies and understand their role in ensuring compliance.
Keep it running
Apply ASD emanation security doctrine: assess areas handling classified data, enforce zoning/separation, use ASD-approved countermeasures, and periodically verify emissions meet doctrine requirements.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The training records related to electromagnetic emissions.
Look at
Dates, attendance lists, and summaries of what was covered.
Good evidence
Record will show regular, comprehensive training sessions at least annually.
- Check 2 of 4What an auditor asks for
Look at
The details of findings, equipment used, and frequency of the scans. The best outcome is clear documentation of periodic checks and resolved issues.
- Check 3 of 4What an auditor asks for
Ask for
Purchasing records of electronic devices. Check the documentation for compliance with ASD's guidelines on electromagnetic emissions. Proper records will indicate that all devices meet emanation security standards.
- Check 4 of 4What an auditor asks for
Ask for
Policy documents relating to device use and storage.
Look at
How policies align with ASD's guidelines and evidence staff have acknowledged them.
Good evidence
Will be current policies circulated within the last 12 months with evidence of staff agreement.
Mappings
Closest match in ISO/IEC 27001: A.7.8, Equipment siting and protection, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.7.8.
ISM-1884 requires compliance with ASD emanation security doctrine for the management of emanation security matters. Annex A 7.8 requires equipment to be sited securely and protected, which includes protecting equipment processing confidential information against leakage through electromagnetic emanation. ISM-1884 is a specialised emanation requirement, while Annex A 7.8 also covers environmental and physical risks to equipment.
This control partially overlaps A.7.12.
ISM-1884 requires compliance with ASD emanation security doctrine for the management of emanation security matters. Emanation security includes protecting cabling against the interception of compromising emanations, which overlaps with the Annex A 7.12 requirement to protect cables from interception and interference. ISM-1884 extends to emanations from all equipment, whereas Annex A 7.12 also covers physical damage to power and data cables.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.