ASD ISM 2070 Control access to recording devices in secure areas
What it says
Unauthorised photographic and video recording devices are not brought into SECRET and TOP SECRET areas.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPrevent unauthorised devices from entering areas where sensitive information is kept.
This control is all about making sure that no one brings unauthorised cameras or recorders into areas where sensitive information is handled. Without this rule, someone could accidentally or intentionally capture secret information, putting the security of important data at risk.
Free. Save your status, tasks and notes.
Why it matters
If recording devices enter SECRET/TOP SECRET areas, they can covertly capture classified material and enable unauthorised disclosure.
How to implement
The office or facility manager should develop and communicate a clear policy: Create a rule that explains what kinds of recording devices can't be brought into secure areas.
Make sure all staff and visitors are aware of this rule through regular communication, like emails or noticeboard announcements.
Security personnel should set up a screening process: At the entrance of secure areas, check bags and belongings for unauthorised recording devices.
This can be done with visual inspections or using metal detectors to ensure no one brings in gadgets by mistake.
IT or security officers should provide secure storage: Create a designated storage area where people can safely leave their devices before entering secure zones.
This storage should be easily accessible but secured by lock and key or another controlled mechanism.
Administrators should train employees: Organise training sessions on the importance of this control and the risks involved with unauthorised recordings.
Content should include examples of potential security breaches resulting from failure to follow this control.
Managers should prominently display signage: Place signs at the entry points of secure areas to remind everyone about the no-device rule.
These signs should be clear and visible, reiterating the importance of leaving recording devices outside.
Keep it running
Implement screening and signage at entry points, provide secure storage for devices, and ensure only approved equipment enters sensitive zones.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A copy of the security policy on devices: Request documentation outlining the policy for controlling recording devices in secure areas.
Look at
Specificity about which devices are restricted and procedures for handling them.
Good evidence
Will be a detailed document that's up-to-date and communicated to all personnel.
- Check 2 of 5What an auditor asks for
Look at
Records of device screenings at secure area entrances. Examine entries for frequency and any noted incidents. Good records will show regular checks with few or no incidents of unauthorised devices found.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of staff training sessions: Request training records that show when staff were trained on this policy.
Look at
Names and dates of participation. Good records will show regular, comprehensive training sessions completed by all staff.
- Check 4 of 5What an auditor asks for
Ask for
To see how devices are stored and managed when people enter secure areas.
Look at
Where the devices are kept and who has access.
Good evidence
Demonstration will show secure and controlled storage available for device users.
- Check 5 of 5What an auditor asks for
Ask for
To see signage around secure areas.
Look at
Signs as described in the policy regarding unauthorised devices. Check placement and clarity. Good signage will be visible, clear in message, and placed at every entry to secure areas.
Mappings
Closest match in ISO/IEC 27001: A.7.2, Physical access controls for secure areas, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.7.2.
ISM-2070 requires organisations to prevent unauthorised photographic and video recording devices from being brought into SECRET and TOP SECRET areas. This relates to ISO/IEC 27001:2022 Annex A 7.2, which requires appropriate entry controls to protect secure areas, and those entry controls can include screening for prohibited devices at access points. Annex A 7.2 is broader because it covers all physical entry/access control measures, whereas ISM-2070 is a specific prohibition focused on recording devices in high-classification areas.
This control partially meets A.7.6.
Annex A 7.6 requires measures to control and protect activities and behaviours within secure areas. ISM-2070 relates by explicitly preventing unauthorised photographic and video recording devices from being brought into SECRET and TOP SECRET areas, controlling a common secure-area threat vector. ISM-2070 is a specific subset of secure-area working measures, while Annex A 7.6 requires a broader suite of protections.
This control depends on A.7.1.
Annex A 7.1 requires organisations to define and use physical security perimeters to protect areas containing information and associated assets. ISM-2070 strengthens those perimeters by reducing the likelihood of covert capture of information within designated SECRET and TOP SECRET areas by prohibiting unauthorised recording devices. While Annex A 7.1 focuses on establishing and enforcing physical boundaries and controlled entry, ISM-2070 is a specific in-area rule addressing information leakage once inside the perimeter.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.