ASD ISM 1973 Secure facilities for non-classified systems
What it says
Non-classified systems are secured in suitably secure facilities.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure non-classified systems are located in secure buildings to prevent unauthorised access.
Imagine if your office was left unlocked overnight. Anyone could walk in and take things. Non-classified systems need to be in secure buildings to prevent unauthorised access. If we don't secure them, we risk someone tampering with our systems or stealing important data.
Free. Save your status, tasks and notes.
Why it matters
If non-classified systems aren't in secure facilities, unauthorised physical access can enable theft, tampering or outages, disrupting operations.
How to implement
Business managers should ensure that the building housing non-classified systems is secure.
They can do this by checking that locks, alarms, and surveillance cameras are installed and working properly. Regularly testing these security measures can help identify weak points.
Office managers should identify where non-classified systems are kept and lock these areas.
This could mean using lockable server rooms or secure cabinets for smaller devices. Ensure that only authorised staff have keys or access codes.
Security personnel should conduct regular patrols around the facility, focusing on entry points.
Set scheduled times for these checks and keep a log of each patrol. This can deter unauthorised attempts to access the facility.
IT staff should keep an inventory of all non-classified systems and their locations.
Maintain this list digitally and update it whenever a system is relocated or replaced. This helps ensure all systems are accounted for and in secure locations.
Training coordinators should provide staff training on security protocols for non-classified systems.
This includes recognising suspicious behaviour and knowing emergency procedures. Conduct training sessions at least annually and after any updates to security measures.
Keep it running
Confirm the facility's locks, visitor controls and access logs work as intended, and review who can enter areas housing non-classified systems.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of physical security measures: Request a documented list of security measures in place for the building where non-classified systems are located.
Look at
The types and locations of these measures. Good includes a detailed list with functioning locks, alarms, and cameras.
- Check 2 of 5What an auditor asks for
Look at
Logs showing who accessed secure areas and when.
Good evidence
Log has regular entries with authorised personnel signatures.
- Check 3 of 5What an auditor asks for
Ask for
Patrol logs: Review logs of security patrols conducted around the facility.
Look at
Regular time-stamped entries that show consistent patrols. Good includes logs without large gaps, indicating routine checks.
- Check 4 of 5What an auditor asks for
Look at
The dates of training and attendance records. Good shows recent, frequent training with high staff attendance.
- Check 5 of 5What an auditor asks for
Ask for
The inventory list: Request an inventory of non-classified systems and their locations.
Look at
A comprehensive list that matches physical observations. Good includes an up-to-date list that reflects the current state of all systems.
Mappings
Closest match in ISO/IEC 27001: A.7.3, Physical security for offices and facilities, which this control partially meets.
ISO/IEC 27001: 6 mappings
This control partially meets A.7.3.
Annex A 7.3 requires physical security for offices, rooms and facilities to be designed and implemented to prevent unauthorised access. ISM-1973 specifically requires non-classified systems to be secured in suitably secure facilities, which is one concrete application of facility-level physical security. ISM-1973 is narrower because it is limited to non-classified systems and does not cover broader office/facility physical security design across all areas addressed by Annex A 7.3.
This control partially meets A.7.5.
Annex A 7.5 requires organisations to implement protections against physical threats (e.g. unauthorised access, vandalism) and environmental threats (e.g. fire, flood) to infrastructure. ISM-1973 relates by requiring non-classified systems to be secured in suitably secure facilities, addressing physical protection of assets. ISM-1973 is a subset focused on facility security for systems, while Annex A 7.5 extends to environmental resilience measures and other infrastructure components.
This control partially overlaps A.7.2.
Annex A 7.2 requires secure areas to be protected by appropriate entry controls and controlled access points. ISM-1973 supports this by requiring non-classified systems to be secured in suitably secure facilities, which typically includes implementing physical access restrictions aligned to Annex A 7.2. ISM-1973 is broader and higher-level about facility suitability, whereas Annex A 7.2 focuses on the specific requirement for entry controls and access point protection.
This control partially overlaps A.7.6.
Annex A 7.6 requires organisations to implement security measures governing activities and behaviours when working in secure areas. ISM-1973 relates by requiring non-classified systems to be secured in suitably secure facilities, which is part of establishing an environment where secure-area work can occur safely. However, ISM-1973 is primarily about facility suitability for hosting systems, whereas Annex A 7.6 is centred on working controls (procedures, supervision, restrictions) within secure areas.
This control partially overlaps A.7.8.
Annex A 7.8 requires equipment to be placed in secure locations and protected from unauthorised access and physical/environmental harm. ISM-1973 relates by mandating that non-classified systems be housed in suitably secure facilities, which is a key mechanism for secure siting. ISM-1973 focuses on facility suitability for a system category, while Annex A 7.8 also covers protections beyond facility selection (e.g., placement within rooms, exposure to hazards, and physical safeguards).
This control supports A.7.4.
ISM-1973 requires non-classified systems to be secured in suitably secure facilities to prevent unauthorised physical access. ISO/IEC 27001:2022 Annex A 7.4 requires continuous monitoring for unauthorised physical access (e.g., CCTV/alarms), which strengthens the facility security posture expected by ISM-1973 by improving detection and response. Monitoring supports ISM-1973's objective but is not the same as ensuring the facility is suitable in the first place (e.g., construction, zoning, and access design).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.