ASD ISM 1974 Securing non-classified IT equipment in secure rooms
What it says
Non-classified servers, network devices and cryptographic equipment are secured in suitably secure server rooms or communications rooms.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishNon-classified IT equipment should be placed in secure rooms to prevent unauthorised physical access.
This control is about making sure that non-classified IT equipment like servers or network gear is kept in secure rooms. This is important to prevent unauthorised people from physically accessing them, which could lead to data breaches, equipment damage, or disruptions in service.
Free. Save your status, tasks and notes.
Why it matters
Without secure server/comms rooms, unauthorised access to servers, network or cryptographic gear can enable tampering, outages and data compromise.
How to implement
Facility managers should identify server or communications rooms that need enhanced security.
Start by listing all equipment that needs such protection and assess current security measures for each location.
IT teams should ensure secure access control to these rooms.
They can do this by installing key card systems or biometric locks which monitor and restrict access to authorised personnel only.
Office managers should regularly review the list of authorised personnel.
They should schedule monthly reviews and update access rights based on changes in staff roles or employment status.
The security team should install surveillance cameras in and around the secure rooms.
Ensure cameras cover all entry points and maintain regular checks to verify recordings are stored properly and accessible if needed.
An external security consultant should conduct annual audits of the physical security measures.
This includes assessing any potential vulnerabilities in the physical security controls and making recommendations for improvement.
Keep it running
Restrict and log entry to server/comms rooms; review access lists regularly; ensure racks/cabinets are locked and equipment is physically secured.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of rooms designated as secure.
Look at
Whether each room is listed with its location and specific security measures.
Good evidence
A comprehensive list with clear identification measures for securing each room.
- Check 2 of 5What an auditor asks for
Ask for
Logs showing who accessed the secure rooms in the last month.
Look at
The names, dates, and times of access.
Good evidence
Detailed logs that match access rights, with no unauthorised entries.
- Check 3 of 5What an auditor asks for
Ask for
The maintenance records of surveillance equipment.
Look at
When cameras and recording devices were last checked or serviced.
Good evidence
Recent and regular maintenance records that show cameras are operational.
- Check 4 of 5What an auditor asks for
Ask for
The list of people authorised to access secure rooms.
Look at
The roles and justification for their access.
Good evidence
A controlled list with justified, regularly updated permissions.
- Check 5 of 5What an auditor asks for
Ask for
The security audit report conducted by an external consultant.
Look at
The identified risks and recommendations.
Good evidence
A thorough report with clear findings and evidence of follow-up actions.
Mappings
Closest match in ISO/IEC 27001: A.7.1, Physical security perimeters, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.7.1.
ISM-1974 requires non-classified servers, network devices, and cryptographic equipment to be secured in suitably secure server rooms or communications rooms to prevent unauthorised physical access. ISO/IEC 27001:2022 Annex A 7.1 requires defined physical security perimeters to protect areas containing information assets, which is the broader mechanism that would encompass securing server/communications rooms. ISM-1974 is a specific application of perimeter-based protection focused on particular types of IT equipment and room types.
This control partially meets A.7.3.
Annex A 7.3 requires an organisation-wide approach to designing and implementing physical security for offices, rooms and facilities. ISM-1974 addresses a subset of that by requiring non-classified servers, network devices and cryptographic equipment to be secured in suitably secure server or communications rooms. ISM-1974 is narrower because it focuses on ICT equipment placement/room security rather than the full spectrum of physical protections for all facilities covered by Annex A 7.3.
This control partially overlaps A.7.8.
Annex A 7.8 requires that equipment is securely placed and physically protected. ISM-1974 relates by requiring non-classified servers, network devices and cryptographic equipment to be secured in suitably secure server rooms or communications rooms, which is a concrete siting/protection requirement. ISM-1974 is targeted to specific equipment types and locations, while Annex A 7.8 remains broader and may include additional protections (e.g. environmental placement, physical barriers) beyond room selection.
This control depends on A.7.2.
ISM-1974 requires non-classified servers, network devices, and cryptographic equipment to be secured in suitably secure server rooms or communications rooms. ISO/IEC 27001:2022 Annex A 7.2 requires entry controls for secure areas, which are a prerequisite for a room to be meaningfully 'secure' against unauthorised physical access. Without Annex A 7.2-style access controls, implementing ISM-1974's secure-room requirement would be incomplete or ineffective.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.