ASD ISM 2008 Criteria for medical devices in SECRET and TOP SECRET areas
What it says
Medical devices authorised to be brought into SECRET and TOP SECRET areas meet, at a minimum, the following criteria: - are listed on the Australian Register of Therapeutic Goods - have been prescribed by a legally qualified medical practitioner - have been commercially purchased within Australia - do not have inbuilt cellular connectivity - can operate independently of mobile devices - where possible, have Wi-Fi, Bluetooth and other forms of wireless connectivity disabled when operating within SECRET and TOP SECRET areas.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMedical devices in secure areas must be safe, approved, and have limited connectivity.
If you're bringing medical devices into highly secure areas, they need to be safe and not too connected to the outside world. This matters because if a device has, for example, Wi-Fi or mobile connectivity that can't be disabled, it could be a way in for hackers to access sensitive information or systems.
Free. Save your status, tasks and notes.
Why it matters
Improperly managed medical devices can be an entry point for cyber attacks in secure areas, risking sensitive data exposure.
How to implement
Procurement should ensure that all medical devices intended for secure areas are purchased from Australian suppliers and listed on the Australian Register of Therapeutic Goods.
This can be verified by checking the supplier's details and registration against official records.
Healthcare professionals must prescribe any medical devices for secure areas, ensuring they are necessary and appropriate.
Arrange a formal prescription from a registered medical practitioner for any device entering these areas.
IT teams should verify and disable any wireless capabilities on medical devices when not needed.
This involves physically inspecting devices and checking settings for Bluetooth, Wi-Fi, and cellular connectivity.
Facility managers should regularly audit devices entering secure areas to ensure compliance.
Implement a checklist process during entry and exit of devices, documenting their connectivity features and any modifications made.
Training teams should prepare staff who manage medical devices on the importance of connectivity restrictions in secure areas.
Hold regular training sessions and provide clear instructions on procedures and steps to follow.
Keep it running
Regular checks of device connectivity settings and staff re-training are necessary to mitigate security risks in sensitive areas.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the list of approved medical devices: Request documentation showing all devices allowed into secure areas with details.
Look at
properly listed devices with prescriptions and supplier information.
Good evidence
is a comprehensive list with each device meeting the criteria.
- Check 2 of 5What an auditor asks for
Good evidence
includes detailed logs confirming disabling of unnecessary wireless functions.
- Check 3 of 5What an auditor asks for
Ask for
training records of staff handling medical devices: Review training completion certificates or attendance sheets.
Look at
regular staff engagement and emphasis on security practices.
Good evidence
shows a consistent training history with focus on security.
- Check 4 of 5What an auditor asks for
Look at
registration details on the Australian Register of Therapeutic Goods.
Good evidence
displays properly documented verification processes for purchases.
- Check 5 of 5What an auditor asks for
Look at
regular maintenance logs indicating compliance with security requirements.
Good evidence
includes checks for device connectivity status and any action taken if non-compliant.
Mappings
Closest match in ISO/IEC 27001: A.7.6, Security measures for working in secure areas, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.7.6.
Annex A 7.6 requires organisations to implement security measures governing work practices within secure areas. ISM-2008 relates by defining strict criteria for medical devices that are authorised to be brought into SECRET and TOP SECRET areas, which is a specific secure-area working measure (controlling what equipment can be used while working). ISM-2008 is highly specific to medical-device risk, while Annex A 7.6 is broader and also covers other behaviours, tools and protective procedures in secure areas.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.