ASD ISM 2070Control Access to Recording Devices in Secure Areas
Official control statement
Unauthorised photographic and video recording devices are not brought into SECRET and TOP SECRET areas.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Prevent unauthorised devices from entering areas where sensitive information is kept.
What this means in practice
This control is all about making sure that no one brings unauthorised cameras or recorders into areas where sensitive information is handled. Without this rule, someone could accidentally or intentionally capture secret information, putting the security of important data at risk.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
S, TS
ISM last updated
Sept 2025
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for physical securitySection
Facilities and systemsTopic
Bringing photographic and video recording devices into facilities
Why it matters
If recording devices enter SECRET/TOP SECRET areas, they can covertly capture classified material and enable unauthorised disclosure.
Operational notes
Implement screening and signage at entry points, provide secure storage for devices, and ensure only approved equipment enters sensitive zones.
Implementation tips
- The office or facility manager should develop and communicate a clear policy: Create a rule that explains what kinds of recording devices can't be brought into secure areas. Make sure all staff and visitors are aware of this rule through regular communication, like emails or noticeboard announcements.
- Security personnel should set up a screening process: At the entrance of secure areas, check bags and belongings for unauthorised recording devices. This can be done with visual inspections or using metal detectors to ensure no one brings in gadgets by mistake.
- IT or security officers should provide secure storage: Create a designated storage area where people can safely leave their devices before entering secure zones. This storage should be easily accessible but secured by lock and key or another controlled mechanism.
- Administrators should train employees: Organise training sessions on the importance of this control and the risks involved with unauthorised recordings. Content should include examples of potential security breaches resulting from failure to follow this control.
- Managers should prominently display signage: Place signs at the entry points of secure areas to remind everyone about the no-device rule. These signs should be clear and visible, reiterating the importance of leaving recording devices outside.
Audit / evidence tips
- AskA copy of the security policy on devices: Request documentation outlining the policy for controlling recording devices in secure areasLook atSpecificity about which devices are restricted and procedures for handling themGoodWill be a detailed document that's up-to-date and communicated to all personnel
- Look atRecords of device screenings at secure area entrances. Examine entries for frequency and any noted incidents. Good records will show regular checks with few or no incidents of unauthorised devices found
- AskEvidence of staff training sessions: Request training records that show when staff were trained on this policyLook atNames and dates of participation. Good records will show regular, comprehensive training sessions completed by all staff
- AskTo see how devices are stored and managed when people enter secure areasLook atWhere the devices are kept and who has accessGoodDemonstration will show secure and controlled storage available for device users
- AskTo see signage around secure areasLook atSigns as described in the policy regarding unauthorised devices. Check placement and clarity. Good signage will be visible, clear in message, and placed at every entry to secure areas
Cross-framework mappings
How ISM-2070 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(2)expand_less | ||
| Annex A 7.2 | ISM-2070 requires organisations to prevent unauthorised photographic and video recording devices from being brought into SECRET and TOP S... | |
| Annex A 7.6 | Annex A 7.6 requires measures to control and protect activities and behaviours within secure areas | |
extensionDepends on(1)expand_less | ||
| Annex A 7.1 | Annex A 7.1 requires organisations to define and use physical security perimeters to protect areas containing information and associated ... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Physical security
See all Guidelines for physical security controls, or browse the full ASD ISM library.