ASD ISM 2166 MACsec secure association lifetime limited to under four hours
What it says
A secure association lifetime of less than four hours (14400 seconds) is used for MACsec connections.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishConfigure MACsec links so each secure association is replaced in under four hours (14400 seconds), limiting how long any one set of session keys stays in use on the link.
MACsec encrypts traffic between two directly connected network devices at the Ethernet layer. The encryption keys it uses are held in a "secure association" (SA), and the SA lifetime is how long one set of keys is used before the devices roll to a fresh one. This control requires that the SA lifetime on MACsec connections is set to less than four hours (14400 seconds). Keys that live for a long time give an attacker more time to collect traffic and more material encrypted under the same key. If a key is ever compromised, everything protected by it during its lifetime is exposed. Rekeying more often shrinks that window: the volume of data under any one key is smaller, and a compromised key becomes useless sooner. In short, a shorter SA lifetime limits how much traffic an attacker could ever decrypt from a single key.
Free. Save your status, tasks and notes.
Why it matters
If MACsec SA lifetimes are left at long or unlimited values, a single set of session keys protects hours or days of link traffic. A key compromise, a cryptographic weakness or a captured traffic stream then exposes far more data than it should, and the organisation cannot demonstrate that its encrypted links meet the ISM's rekeying expectation.
How to implement
Network engineers should inventory every MACsec connection in the environment and record the currently configured secure association lifetime or rekey interval for each end of each link.
Network engineers should set the MACsec SA lifetime (rekey timer) on every MACsec-capable device to a value below 14400 seconds, using the vendor's timer or key-lifetime parameter, and apply it consistently at both ends of each link.
The network architecture owner should update the standard MACsec configuration template and build guide so the sub-four-hour lifetime is applied automatically to any new MACsec link.
Network operations should add an automated configuration compliance check (for example a script or network configuration manager rule) that flags any MACsec interface whose SA lifetime is 14400 seconds or higher.
The change manager should add a checklist item to MACsec-related changes, firmware upgrades and device replacements requiring the SA lifetime to be verified against the four-hour limit before the change is closed.
Keep it running
Treat the SA lifetime as a standard setting in the MACsec configuration template used for switches, routers and any other devices that terminate MACsec links. Network engineers should set the rekey interval (often expressed as a timer in seconds or minutes in vendor configuration) to a value below 14400 seconds and confirm that both ends of each link agree, since a mismatch can cause rekey failures or link flaps.
Day to day, watch for configuration drift: firmware upgrades, device replacements and copied configurations can silently reintroduce a vendor default that exceeds four hours. Include the SA lifetime in configuration compliance checks and in the change-approval checklist for any new or modified MACsec link. When troubleshooting MACsec links, do not "fix" instability by lengthening the lifetime beyond the limit; resolve the underlying key agreement issue instead.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the list of all MACsec connections and the configured secure association lifetime for each end.
Look at
Check that every link is listed and that a lifetime value is recorded for both devices on each link.
Good evidence
Every MACsec link shows a lifetime below 14400 seconds at both ends, with no gaps or unknown values.
- Check 2 of 5What an auditor asks for
Ask for
Ask for running configuration exports from a sample of MACsec-enabled devices.
Look at
Find the MACsec or MKA policy section and read the rekey timer or key lifetime parameter.
Good evidence
The configured value is explicitly set below four hours rather than relying on an unstated vendor default.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the standard MACsec configuration template or build guide.
Look at
Look for the SA lifetime setting and the value it prescribes.
Good evidence
The template mandates a lifetime under 14400 seconds so new links inherit the setting automatically.
- Check 4 of 5What an auditor asks for
Ask for
Ask for output from the configuration compliance tool or script that checks MACsec settings.
Look at
Check whether the SA lifetime is one of the checked parameters and review recent results.
Good evidence
Recent checks cover the lifetime, and any device found above the limit was remediated with a record of the fix.
- Check 5 of 5What an auditor asks for
Ask for
Ask for change records for recent MACsec changes, firmware upgrades or device replacements.
Look at
Look for evidence that the SA lifetime was verified after the change.
Good evidence
Change records show the lifetime was confirmed below four hours before closure, demonstrating the setting survives routine changes.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
ISM-2166 requires configuring MACsec so each secure association (and its session keys) is replaced in under four hours to reduce exposure from long-lived link-layer keys. Annex A 8.20 requires networks and network devices to be secured, managed, and controlled, which can include securing Layer 2 links and enforcing cryptographic session/key lifetimes on network infrastructure. ISM-2166 is a very specific technical parameter for one network security mechanism, while Annex A 8.20 is broader and technology-agnostic.
This control partially meets A.8.24.
ISM-2166 requires regular MACsec secure association rekeying (under four hours), directly limiting cryptographic key lifetime for MACsec session keys. Annex A 8.24 requires defining and implementing cryptography and key management rules, which commonly include maximum key/session lifetimes and rekeying processes for cryptographic protections. ISM-2166 is an implementation-level requirement for MACsec specifically, whereas Annex A 8.24 covers key management across all cryptographic uses in the organisation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.