ISM control lookup / Topic

Guidelines for physical security

19 controls · September 2026 edition

• ISM-0161 · Securing IT equipment and media

  IT equipment and media are secured when not in use.

• ISM-0164 · Preventing observation by unauthorised people

  Unauthorised people are prevented from observing systems, in particular workstation displays and keyboards, within facilities.

• ISM-0225 · Bringing radio frequency and infrared devices into facilities

  Unauthorised RF and IR devices are not brought into SECRET and TOP SECRET areas.

• ISM-0810 · Physical access to systems

  Classified systems are secured in facilities that meet the requirements for a security zone suitable for their classification.

• ISM-0813 · Physical access to servers, network devices and cryptographic equipment

  Server rooms, communications rooms and security containers are not left in unsecured states.

• ISM-0829 · Bringing radio frequency and infrared devices into facilities

  Security measures are used to detect and respond to unauthorised RF devices in SECRET and TOP SECRET areas.

• ISM-1053 · Physical access to servers, network devices and cryptographic equipment

  Classified servers, network devices and cryptographic equipment are secured in server rooms or communications rooms that meet the requirements for a security zone suitable for their classification.

• ISM-1074 · Physical access to servers, network devices and cryptographic equipment

  Keys or equivalent access mechanisms to server rooms, communications rooms and security containers are appropriately controlled.

• ISM-1296 · Physical access to network devices in public areas

  Physical security is implemented to protect network devices in public areas from physical damage or unauthorised access.

• ISM-1530 · Physical access to servers, network devices and cryptographic equipment

  Classified servers, network devices and cryptographic equipment are secured in security containers suitable for their classification taking into account the combination of security zones they reside in.

• ISM-1543 · Bringing radio frequency and infrared devices into facilities

  An authorised RF and IR device register for SECRET and TOP SECRET areas is developed, implemented, maintained and regularly verified.

• ISM-1973 · Physical access to systems

  Non-classified systems are secured in suitably secure facilities.

• ISM-1974 · Physical access to servers, network devices and cryptographic equipment

  Non-classified servers, network devices and cryptographic equipment are secured in suitably secure server rooms or communications rooms.

• ISM-1975 · Physical access to servers, network devices and cryptographic equipment

  Non-classified servers, network devices and cryptographic equipment are secured in suitably secure security containers.

• ISM-2007 · Bringing medical devices into facilities

  An authorised medical device register for SECRET and TOP SECRET areas is developed, implemented, maintained and regularly verified.

• ISM-2008 · Bringing medical devices into facilities

  Medical devices authorised to be brought into SECRET and TOP SECRET areas meet, at a minimum, the following criteria:

• ISM-2009 · Bringing medical devices into facilities

  Unauthorised medical devices are not brought into SECRET and TOP SECRET areas.

• ISM-2069 · Bringing photographic and video recording devices into facilities

  An authorised photographic and video recording device register for SECRET and TOP SECRET areas is developed, implemented, maintained and regularly verified.

• ISM-2070 · Bringing photographic and video recording devices into facilities

  Unauthorised photographic and video recording devices are not brought into SECRET and TOP SECRET areas.