What does ASD ISM 2163 require?

policyASD Information Security Manual (ISM)

ASD ISM 2163Enable MACsec Confidentiality Mode Using GCM-AES Cipher Suites

Where MACsec is used, turn on confidentiality (encryption) mode with an approved GCM-AES cipher suite, preferring the 256-bit options, so link traffic is encrypted rather than only integrity-checked.

Preventative NC OS PASD Information Security ManualGuidelines for networking cryptography network security

record_voice_over

Plain language

MACsec (IEEE 802.1AE) protects Ethernet traffic hop by hop between devices such as switches, routers and hosts. It can run in two ways: integrity-only mode, which detects tampering but leaves frames readable, or confidentiality mode, which also encrypts the frame payload. This control says that whenever your organisation uses MACsec, confidentiality mode must be switched on and must use one of four named cipher suites: GCM-AES-128, GCM-AES-256, GCM-AES-XPN-128 or GCM-AES-XPN-256. Of those, GCM-AES-256 or GCM-AES-XPN-256 are preferred because of their larger key size. The XPN (extended packet numbering) variants use a 64-bit packet number instead of 32-bit, which matters on high-speed links where the packet counter would otherwise wrap quickly and force very frequent re-keying. Why it matters: MACsec is typically deployed precisely because a link crosses somewhere the organisation cannot fully trust, such as a cable run through a shared building, a carrier-provided Layer 2 service, or an inter-rack link in a co-located data centre. If MACsec is left in integrity-only mode, or configured with a weak or non-approved cipher, anyone who can tap the cable or the intermediate equipment can read every frame in clear text. Enabling confidentiality mode with an approved GCM-AES suite closes that gap and gives both encryption and authentication of the traffic in a single, well-understood algorithm.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

Sept 2026

Control Stack last updated

05 Sept 2026

E8 maturity levels

N/A

Guideline

Guidelines for networking

Section

Wired networks

Topic

Media Access Control Security

Official control statement

When using MACsec, confidentiality protection mode is enabled using GCM-AES-128, GCM-AES-256, GCM-AES-XPN-128 or GCM-AES-XPN-256, preferably GCM-AES-256 or GCM-AES-XPN-256.

policyASD Information Security Manual (ISM)ISM-2163

priority_high

Why it matters

If MACsec is deployed without confidentiality mode, or with a cipher suite outside the approved GCM-AES set, the link still looks "secured" in diagrams and configuration reviews while frames actually travel in the clear or under weaker protection. An attacker with physical or logical access to the cabling, patch panel, carrier equipment or an in-path device could capture credentials, session data and any other unencrypted higher-layer traffic. The organisation would also be non-compliant with the ISM cryptographic requirements for MACsec, which may affect accreditation of systems that rely on that link. Using 128-bit suites where 256-bit is available forgoes the preferred security margin without any operational benefit.

settings

Operational notes

Day to day, this control lives in the configuration of every MACsec-capable interface. Network engineers should treat "confidentiality mode on, cipher suite GCM-AES-256 or GCM-AES-XPN-256" as the default template for any new MACsec link, and only fall back to a 128-bit suite where a peer device genuinely cannot support 256-bit (and record that decision).

Watch for platform defaults: many switches and routers default to GCM-AES-128 or to integrity-only when MACsec is first enabled, and some require the cipher suite to be set in a policy that is then applied to the interface. Both ends of a link must agree on the suite, so a mismatch will usually show as the MACsec session failing to establish or falling back. Confirm which side is negotiating what after any firmware upgrade, hardware replacement or configuration restore, because those events commonly reset cipher settings.

On links of 10 Gbps and above, prefer the XPN variants so the packet number does not exhaust and force constant re-keying. Include MACsec cipher and mode settings in configuration compliance checks or a golden-config comparison so drift is caught rather than discovered during an audit.

02 - Implement

build

Implementation tips

Network engineering team: inventory every link where MACsec is or will be enabled (inter-switch, switch-to-host, WAN or carrier Ethernet) by exporting interface configurations from each device and recording the current MACsec mode and cipher suite for each.
Network engineering team: set the MACsec policy on each device to confidentiality mode (not integrity-only) and select GCM-AES-256 or GCM-AES-XPN-256 as the cipher suite, using the vendor's MACsec policy or profile commands, then apply that policy to every MACsec interface.
Network engineering team: where a peer device cannot support a 256-bit suite, configure GCM-AES-128 or GCM-AES-XPN-128 as the fallback, document the specific device and reason in the change record, and raise a task to upgrade or replace that device so the preferred suite can be adopted.
Network engineering team: for high-throughput links, choose the XPN variant (GCM-AES-XPN-256 preferred) so extended packet numbering is used, then verify both ends negotiate the same suite by checking the MACsec session status output on each device after the change.
Network operations or platform team: add the MACsec mode and cipher suite settings to the standard device configuration template and to automated configuration compliance checks, so any new interface, restored configuration or firmware upgrade that reverts to integrity-only or a non-approved suite is flagged and corrected.

03 - Audit

fact_check

Audit / evidence tips

AskAsk for the list of links or interfaces where MACsec is in use, together with the running configuration for each device involved.Look atCheck that every MACsec interface or policy explicitly sets confidentiality mode and names one of GCM-AES-128, GCM-AES-256, GCM-AES-XPN-128 or GCM-AES-XPN-256.GoodAll MACsec interfaces have confidentiality enabled and use an approved GCM-AES suite, with GCM-AES-256 or GCM-AES-XPN-256 on the large majority of links.
AskAsk for the live MACsec session or status output from both ends of a sample of links.Look atLook at the negotiated cipher suite and whether the session shows encryption (confidentiality) active rather than integrity-only.GoodThe negotiated suite on both ends matches the configured suite, encryption is shown as active, and no link is silently running in integrity-only mode.
AskAsk for the standard device configuration template or MACsec policy used for new deployments.Look atCheck whether the template defaults to confidentiality mode with GCM-AES-256 or GCM-AES-XPN-256, rather than relying on vendor defaults.GoodThe template hard-codes the preferred 256-bit suite and confidentiality mode, so new links are compliant without manual intervention.
AskAsk for records of any links using a 128-bit suite (GCM-AES-128 or GCM-AES-XPN-128) and the justification for each.Look atLook for a documented technical reason (such as a peer device limitation) and a plan or ticket to move to a 256-bit suite.GoodEvery 128-bit exception is documented, approved and tracked toward remediation rather than being an unexplained default.
AskAsk for evidence of configuration compliance or drift checks covering MACsec settings.Look atCheck that the checks would detect a change to integrity-only mode or to a non-approved cipher suite, and review recent results.GoodMACsec mode and cipher suite are part of routine compliance checking, recent results show no unapproved drift, and any findings were remediated.

04 - Mappings

link

Cross-framework mappings

How ISM-2163 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
layersPartially meets(2)expand_less
Annex A 8.20	ISM-2163 requires that where MACsec is used, confidentiality mode is enabled using approved GCM-AES cipher suites (preferably 256-bit), e...
Annex A 8.24	ISM-2163 mandates specific cryptographic selections for MACsec confidentiality mode (GCM-AES-128/256 and XPN variants), effectively defin...