What does ASD ISM 2009 require?

policyASD Information Security Manual (ISM)

ASD ISM 2009Restrict Medical Devices in SECRET and TOP SECRET Areas

Ensure unauthorised medical devices are not brought into SECRET and TOP SECRET areas.

Preventative S TSASD Information Security ManualGuidelines for physical security Access control Authentication

record_voice_over

Plain language

This control ensures that medical devices which have not been authorised are kept out of SECRET and TOP SECRET areas. Many medical devices contain microphones, cameras, wireless radios or storage that could capture or leak classified information, so they cannot be brought in freely. Anyone who needs a medical device in these areas must have it checked and approved beforehand. This protects highly sensitive information from accidental or deliberate compromise.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Preventative

Classifications

S, TS

ISM last updated

Mar 2025

Control Stack last updated

10 Aug 2026

E8 maturity levels

N/A

Guideline

Guidelines for physical security

Section

Facilities and systems

Topic

Bringing Medical Devices Into Facilities

Official control statement

Unauthorised medical devices are not brought into SECRET and TOP SECRET areas.

policyASD Information Security Manual (ISM)ISM-2009

priority_high

Why it matters

Without this control, medical devices carrying hidden radios, cameras or storage could enter SECRET and TOP SECRET areas and covertly capture or exfiltrate classified information.

settings

Operational notes

Review medical device authorisations regularly and revoke them promptly when a device or its holder changes.

02 - Implement

build

Implementation tips

Security officers should document a policy that prohibits medical devices in SECRET and TOP SECRET areas unless each device is individually authorised.
Establish an authorisation process so that staff formally request approval for any required medical device before taking it into these areas.
The authorising authority should assess each requested medical device for wireless, recording and storage capabilities before granting approval, and record the decision.
Display clear signage at every entry point to SECRET and TOP SECRET areas stating that unauthorised medical devices are not permitted.
Brief personnel and visitors during security inductions on the medical device restriction and the process for requesting an exemption.

03 - Audit

fact_check

Audit / evidence tips

AskAsk for the policy governing medical devices in SECRET and TOP SECRET areas.GoodA current policy that explicitly prohibits unauthorised medical devices in SECRET and TOP SECRET areas and defines an approval process.
AskAsk how requests to bring a medical device into these areas are assessed and approved.GoodDocumented assessments that consider wireless, recording and storage risks, each with a named approver and a dated decision.
AskAsk what controls stop unauthorised medical devices from entering these areas.GoodSignage at entry points plus induction records showing that personnel are informed of the restriction.
AskAsk for a record of medical devices currently authorised in these areas.GoodAn up-to-date register listing each authorised device, its holder, and the basis for approval.
AskAsk how compliance with the restriction is monitored and enforced.GoodEvidence of periodic checks and recorded actions taken whenever an unauthorised device is found.

04 - Mappings

link

Cross-framework mappings

How ISM-2009 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
layersPartially meets(2)expand_less
Annex A 8.3	ISM-2009 requires authenticated and authorised API clients for network API operations that modify data, enforcing least-privilege access ...
Annex A 8.5	ISM-2009 requires that any client invoking a network API that can change data is authenticated and authorised at the API boundary, includ...