What does ASD ISM 2165 require?

policyASD Information Security Manual (ISM)

ASD ISM 2165Fresh EAP-TLS Authentication for Each New Connectivity Association Key

Devices using EAP-TLS for MACsec Key Agreement (MKA) must re-authenticate with a fresh EAP-TLS exchange whenever they need a new Connectivity Association Key, rather than reusing an old session or key.

Preventative NC OS PASD Information Security ManualGuidelines for networking authentication

record_voice_over

Plain language

A Connectivity Association Key (CAK) is the master key that MACsec Key Agreement (MKA) uses to protect a MACsec link between two devices. Where EAP-TLS is used to establish that key, each device proves its identity with a certificate and the key material is derived from the resulting authentication. This control says the derivation must not be a one-off. Every time a device needs a new CAK (for example, when the existing one is due to be replaced), that device must go through a complete, fresh EAP-TLS authentication. It must not simply reuse a previous authentication, resume an old TLS session (for example through EAP-TLS fast reconnect or TLS session resumption), or roll the key forward from earlier material without re-authenticating. Why it matters: if a new CAK is produced without a fresh authentication, the link continues to trust a device on the strength of an identity check that may be stale. A certificate that has since been revoked, a device that has since been compromised, or a session that has been hijacked would keep receiving new keys. Forcing a fresh EAP-TLS authentication each time ties every new key to a current, verified identity and limits how long any single authentication remains useful to an attacker.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

Sept 2026

Control Stack last updated

05 Sept 2026

E8 maturity levels

N/A

Guideline

Guidelines for networking

Section

Wired networks

Topic

Media Access Control Security

Official control statement

When using EAP-TLS, each device performs a fresh EAP-TLS authentication each time a new Connectivity Association Key is required.

policyASD Information Security Manual (ISM)ISM-2165

priority_high

Why it matters

If devices obtain new Connectivity Association Keys without performing a fresh EAP-TLS authentication, key rollover stops being a security checkpoint. A device whose certificate has been revoked, or which has been compromised since it last authenticated, can keep receiving new keys and keep participating in the protected link. Key material may also be derived from old session state, weakening the independence of each new key. The organisation loses confidence that every key on the link belongs to a currently authorised device, and the compromise window extends across multiple key lifetimes instead of ending at the next rollover.

settings

Operational notes

In day-to-day operation this control shows up as configuration on the devices and the authentication server rather than as a manual task. Network engineers need to confirm that the EAP-TLS and key management settings on each participating device require a full authentication when a new CAK is needed, and that nothing in the configuration allows the device to skip that step by reusing a cached session or a prior authentication result.

Operations teams should expect to see an EAP-TLS authentication event on the authentication server that lines up with each CAK change on each device. Where those events are missing, or the count of authentications is lower than the count of key changes, the configuration should be checked. Certificate expiry and revocation handling also matter here, because a fresh authentication is only useful if the server is checking current certificate status. Changes to device firmware, authentication server software, or key rollover settings should be reviewed to make sure the fresh-authentication behaviour is preserved.

02 - Implement

build

Implementation tips

Network engineers configure each device that uses EAP-TLS to derive its Connectivity Association Key from a fresh EAP-TLS authentication, and disable EAP-TLS fast reconnect, TLS session resumption and any other option that lets the device reuse a previous authentication or cached session when a new CAK is required.
Network engineers set the CAK rollover parameters on each device so that the request for a new CAK triggers a complete EAP-TLS exchange, and record the configured rollover trigger and the expected authentication behaviour in the device build standard.
The authentication server administrator configures the EAP-TLS policy on the RADIUS server that serves MACsec devices to treat every CAK-related authentication as a full authentication, with fast reconnect and TLS session resumption disabled so that each new CAK is tied to a complete certificate-based exchange.
The network team tests the behaviour on a representative device by forcing a new CAK and confirming, from both the device log and the authentication server log, that a fresh EAP-TLS authentication was performed before the new key was used.
The change manager adds a check to the change process for network devices and authentication servers so that firmware upgrades, template changes and server updates are verified to keep the fresh-authentication-per-CAK behaviour before they are approved.

03 - Audit

fact_check

Audit / evidence tips

AskAsk for the running configuration or configuration template for a sample of devices that use EAP-TLS to establish Connectivity Association Keys.Look atLook at the EAP-TLS and key management settings to see whether a new CAK requires a full EAP-TLS authentication, and whether any setting (such as EAP-TLS fast reconnect or TLS session resumption) permits session reuse or cached authentication.GoodThe configuration shows that each new CAK is tied to a fresh EAP-TLS authentication, with no session-reuse or cached-authentication options enabled.
AskAsk for authentication server logs covering a period in which CAK rollovers occurred on the sampled devices.Look atCompare the timestamps of CAK changes on the devices with EAP-TLS authentication events on the server for the same device identities.GoodEvery CAK change on each sampled device is matched by a fresh EAP-TLS authentication event immediately beforehand.
AskAsk for the device build standard or design document that describes how EAP-TLS and CAK management are configured.Look atCheck that the document states the fresh-authentication requirement for each new CAK and that the standard matches what is actually configured.GoodThe standard explicitly requires a fresh EAP-TLS authentication for every new CAK and the sampled configurations match it.
AskAsk for the results of the most recent test in which a new CAK was forced on a device.Look atReview the device and server log extracts captured during the test to see whether a complete EAP-TLS exchange preceded the new key.GoodThe test record shows a full EAP-TLS authentication occurred before the new CAK was used, and the test is repeated after relevant changes.
AskAsk for the RADIUS server configuration for the EAP-TLS policy applied to MACsec devices.Look atLook for EAP-TLS fast reconnect, TLS session resumption or session caching settings that would let a device obtain a new CAK on a resumed session instead of a full authentication.GoodFast reconnect and session resumption are disabled for the MACsec policy, so every CAK-related authentication is a complete EAP-TLS exchange. Certificate revocation checking, assessed under its own ISM controls, then applies to each of those exchanges.

04 - Mappings

link

Cross-framework mappings

How ISM-2165 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
layersPartially meets(2)expand_less
Annex A 5.15	ISM-2165 mandates that EAP-TLS sessions are not reused for CAK establishment by requiring a fresh EAP-TLS authentication whenever a new C...
Annex A 8.5	ISM-2165 requires a specific behaviour for 802.1X EAP-TLS: each device must perform a fresh EAP-TLS authentication every time a new Conne...
handshakeSupports(1)expand_less
Annex A 5.17	ISM-2165 requires devices to successfully perform a fresh EAP-TLS authentication for each new CAK, which relies on correct handling of cr...