ASD ISM 2007 Authorised medical device register for SECRET and TOP SECRET areas
What it says
An authorised medical device register for SECRET and TOP SECRET areas is developed, implemented, maintained and regularly verified.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeep, maintain and regularly check an approved list of medical devices allowed into SECRET and TOP SECRET areas.
Some areas in your organisation hold information classified as SECRET or TOP SECRET (the two highest levels of government classification). This control says you must create and keep an official list (a register) of every medical device that is allowed into those areas, such as a pacemaker, insulin pump, hearing aid or other personal medical item. Many of these devices contain wireless transmitters, microphones or memory, so an unapproved one could secretly record or leak sensitive information. The register has to be set up, put into use, kept up to date, and checked on a regular basis to make sure it stays accurate.
Free. Save your status, tasks and notes.
Why it matters
An unrecorded medical device with a hidden microphone, transmitter or memory could leak SECRET or TOP SECRET information, causing a serious national security breach.
How to implement
The security manager creates a single register that records each approved medical device, the person who relies on it, the SECRET or TOP SECRET area it is permitted in, and the date it was authorised.
The person needing a medical device in a classified area submits a written request, and a delegated approver checks the device's wireless, recording and storage features before adding it to the register.
The facility security officer puts the register into active use by checking devices against it at entry points to SECRET and TOP SECRET areas before anyone is allowed in.
The register owner keeps the list current by adding new devices, removing devices for people who have left or changed roles, and updating entries whenever a device is replaced or upgraded.
The security team schedules a regular verification (for example every quarter) where they reconcile the register against people actually working in those areas and confirm each listed device is still genuinely required.
Keep it running
Review the register on a set schedule and whenever staff or devices change, so it always reflects exactly who is permitted to bring which device into classified areas.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
to see the authorised medical device register itself.
Look at
whether it covers SECRET and TOP SECRET areas specifically and lists each device with its owner and authorisation date.
Good evidence
is a single controlled document that is complete and clearly owned.
- Check 2 of 5What an auditor asks for
Ask for
who has authority to approve a medical device for entry into these areas.
Look at
a named role and a documented approval step.
Good evidence
shows approvals are made by a delegated officer after assessing the device's risk features.
- Check 3 of 5What an auditor asks for
Ask for
how the register is used at the point of entry.
Look at
access procedures or guard instructions for classified areas.
Good evidence
shows staff actually check devices against the register before granting access.
- Check 4 of 5What an auditor asks for
Ask for
how the register is kept up to date.
Look at
recent entries showing additions and removals when people or devices change.
Good evidence
shows the list is living, not a one-off document created years ago.
- Check 5 of 5What an auditor asks for
Ask for
evidence of the regular verification activity.
Look at
dated reconciliation records, sign-offs or review notes.
Good evidence
shows scheduled checks confirming every listed device is still authorised and required.
Mappings
Closest match in ISO/IEC 27001: A.7.2, Physical access controls for secure areas, which this control depends on.
ISO/IEC 27001: 1 mapping
This control depends on A.7.2.
ISM-2007 requires organisations to control medical devices in SECRET and TOP SECRET areas by maintaining and verifying an authorised device register. This supports Annex A 7.2 because effective entry controls for secure areas commonly include controlling what devices can be brought through access points, not just who can enter. Annex A 7.2 focuses on physical entry controls, while ISM-2007 focuses on device authorisation/traceability once access is sought or granted.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.