ASD ISM 2164 Set MACsec connectivity association lifetime below 24 hours
What it says
A connectivity association lifetime of less than 24 hours (86400 seconds) is used for MACsec connections.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishConfigure every MACsec link so its connectivity association expires and re-keys in under 24 hours (less than 86400 seconds), rather than persisting indefinitely.
MACsec (Media Access Control Security) encrypts traffic on a network link between two devices, such as a switch and a router or a switch and a server. When the two ends agree to protect a link, they form a connectivity association (CA): a security relationship that governs the keys used to encrypt and authenticate the traffic on that link. This control requires that a connectivity association is not allowed to live for a full day. Its lifetime must be set to less than 24 hours, which is less than 86400 seconds, so that the association is renewed and fresh keying material is established at least once a day. Why it matters: the longer a single connectivity association and its keys are in use, the more encrypted traffic is protected under the same material, and the more valuable and exposed that material becomes. If an attacker recovers or misuses the keys for a link, a short lifetime limits how much traffic they can decrypt and how long they can keep exploiting the association before it is replaced. Keeping the lifetime under a day caps that exposure window and keeps link encryption fresh across the network.
Free. Save your status, tasks and notes.
Why it matters
If MACsec connectivity associations are left at a default or unlimited lifetime, or set to 24 hours or more, a compromised or weakened association stays valid for far longer than intended. An attacker who obtains the keying material can decrypt or tamper with link traffic for the whole time the association persists, and large volumes of traffic are protected by the same keys, increasing the value of any successful attack. The organisation also fails to meet this ISM control, which is likely to be raised as a finding in an ISM or IRAP assessment of the network.
How to implement
Network engineering team: inventory every MACsec-protected link in the environment, recording the devices at both ends, so that the lifetime setting can be verified on each device that terminates a connectivity association.
Network engineering team: set the MACsec connectivity association lifetime on each of those devices to a value below 86400 seconds using the vendor's MACsec or MKA configuration commands, and confirm the value is applied on both peers of each link.
Network architecture or standards owner: add the sub-24-hour lifetime to the organisation's network device configuration baseline and templates, so any new MACsec link is deployed with a compliant value rather than a vendor default.
Network operations team: after applying the setting, verify on a sample of links that the connectivity association actually renews within the configured period by checking the device's MACsec or MKA session status or logs over more than one lifetime cycle.
Network operations team: build a scheduled configuration compliance check (script or network management tool) that reads the MACsec lifetime from every MACsec-enabled device and flags any device where the value is missing, 86400 seconds or higher, or differs between the two ends of a link.
Keep it running
In practice this is a configuration setting on the network devices that terminate MACsec links (typically switches, routers and, where used, host adapters). The lifetime value must be strictly below 86400 seconds; a value of exactly 86400 does not meet the control, so teams commonly choose a figure comfortably lower to avoid edge cases.
Network engineers should treat the lifetime as part of the standard MACsec build: it belongs in the device configuration template or baseline so that every new MACsec link inherits a compliant value, and it should be checked whenever a link is stood up, a device is replaced, or a configuration is restored from backup. Both ends of a link should be reviewed, since a lifetime is set per device and a mismatch or an unconfigured peer can leave one side non-compliant. Periodic configuration audits, whether by script, network management tooling or manual review, should confirm the value has not drifted back to a vendor default.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the list of MACsec-protected links and the devices that terminate them.
Look at
Check that the list covers all MACsec links in scope and names both peer devices for each link, so the lifetime can be traced to every endpoint.
Good evidence
A complete, current inventory exists and each link can be matched to specific device configurations.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the running configuration of a sample of MACsec-enabled devices from both ends of several links.
Look at
Locate the connectivity association or MKA lifetime setting and confirm the configured value in seconds.
Good evidence
Every sampled device shows a lifetime strictly below 86400 seconds, and the two peers of each link are consistent.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the network device configuration baseline or template used for MACsec deployments.
Look at
Check whether the sub-24-hour lifetime is written into the baseline rather than relying on engineers to set it by hand.
Good evidence
The baseline mandates a specific value below 86400 seconds and new MACsec links are built from it.
- Check 4 of 5What an auditor asks for
Ask for
Ask for MACsec or MKA session status output or logs covering more than a day for a sample of links.
Look at
Check that connectivity associations are being renewed within the configured lifetime rather than persisting past 24 hours.
Good evidence
Session records show re-keying or association renewal occurring at intervals under 24 hours.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the results of the most recent configuration compliance check covering MACsec lifetimes.
Look at
Review what the check tests, how often it runs, and how exceptions such as devices at a vendor default were handled.
Good evidence
A recurring check exists, it tests for values below 86400 seconds on every MACsec device, and any deviations were corrected and recorded.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
ISM-2164 requires each MACsec link to use a connectivity association lifetime under 24 hours to enforce regular re-keying. ISO/IEC 27001:2022 Annex A 8.20 necessitates securing and managing networks and network devices, which can include configuring link-layer security parameters like MACsec key lifetimes. Annex A 8.20 is broader and technology-agnostic, whereas ISM-2164 is a specific configuration requirement for MACsec.
This control partially meets A.8.24.
ISM-2164 requires a MACsec connectivity association to expire and re-key in less than 24 hours, which is a specific key/association lifetime rule. ISO/IEC 27001:2022 Annex A 8.24 mandates rules for effective cryptography use and cryptographic key management, where defining rotation or re-key intervals is typical. Annex A 8.24 applies across cryptographic technologies and keys generally, while ISM-2164 is specific to MACsec connectivity association lifetimes.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.