ASD ISM 1975 Secure non-classified equipment in safe containers
What it says
Non-classified servers, network devices and cryptographic equipment are secured in suitably secure security containers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSecure non-classified equipment in secure containers to protect against unauthorised physical access.
This control is about making sure that equipment like servers or network devices, which are not classified but still important, are kept safe in secure containers. This matters because if someone can physically access this equipment without authorisation, they could steal information, damage it, or disrupt your business operations.
Free. Save your status, tasks and notes.
Why it matters
If non-classified servers, network devices or cryptographic equipment are not locked in secure containers, they can be accessed or tampered with, causing data theft and service disruption.
How to implement
Managers should identify all non-classified equipment in their facilities that need protection.
Make a list of items like servers and network devices, then find out where they are currently stored and whether they are adequately secured.
The IT team should select and install sturdy, lockable cabinets or containers to safeguard the equipment.
Ensure these containers are placed in locations that are not easily accessible to unauthorised people, and install locks that have physical keys or password systems only available to those who need access.
Facility managers should coordinate with security personnel to monitor access to areas containing the secure containers.
Use cameras or regular security patrols to deter unauthorised access or tampering.
IT personnel should regularly audit the contents of the secure containers to ensure all equipment is accounted for.
Develop a checklist to verify that each piece of equipment is in place and have explanations ready for any discrepancies.
Managers should train staff on the importance of physical security and the protocols for accessing secured containers.
Offer regular sessions to keep everyone updated on the procedures and the reasons for their importance.
Keep it running
Inspect safe containers routinely (locks, hinges, bolts and tamper evidence), confirm only authorised staff hold keys/combinations, and log access to equipment stored inside.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
An inventory list of all non-classified equipment: Request a comprehensive document detailing each piece of non-classified equipment and its location.
Look at
Equipment IDs, current storage solutions, and assigned responsibility.
Good evidence
Is a well-documented list showing each item is accounted for and secured appropriately.
- Check 2 of 5What an auditor asks for
Ask for
To see the acquisition records for secure containers: Request documentation demonstrating that secure containers were purchased and installed.
Look at
Purchase receipts, installation dates, and descriptions of the containers' security features. Good evidence will be clear records showing the containers are fit for purpose and correctly installed.
- Check 3 of 5What an auditor asks for
Ask for
Logs detailing who accessed the container areas and when.
Look at
Names, times, and reasons for access.
Good evidence
Consists of detailed records showing all entries are by authorised personnel.
- Check 4 of 5What an auditor asks for
Look at
Audit reports of secured equipment: Request any reports from audits conducted on the secured containers' contents. Check for evidence of regular audits, dates of the audits, and actions taken.
Good evidence
Example shows all equipment accounted for with actions indicated for any issues found.
- Check 5 of 5What an auditor asks for
Ask for
Staff training records on security protocols: Request evidence of training sessions conducted for staff on accessing secure containers.
Look at
Attendance sheets, training materials, and feedback forms.
Good evidence
Provides proof of consistent training reinforcing the policy among relevant staff.
Mappings
Closest match in ISO/IEC 27001: A.7.8, Equipment siting and protection, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.7.8.
Annex A 7.8 requires equipment to be sited securely and protected to reduce unauthorised access and physical compromise. ISM-1975 relates by requiring certain non-classified equipment to be secured in suitably secure security containers, which is a protective siting approach at the container level. ISM-1975 is narrower and container-focused for a defined equipment set, whereas Annex A 7.8 also covers broader siting decisions and environmental/physical safeguards.
This control depends on A.7.1.
Annex A 7.1 requires organisations to define and use physical security perimeters to protect areas containing information and associated assets. ISM-1975 supports this by requiring non-classified servers, network devices and cryptographic equipment to be secured in suitably secure containers, effectively creating a localised perimeter around critical assets. Annex A 7.1 is primarily about boundary controls for areas, while ISM-1975 is about containerisation of equipment even where the surrounding area perimeter may be weaker.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.