ASD ISM 0161 Ensure security of unused IT equipment and media
What it says
IT equipment and media are secured when not in use.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishIT equipment and media are protected against unauthorised access when not actively being used.
This control is about making sure that computers, hard drives, and other tech devices are safely locked away when you're not using them. It's important because if someone can get to them when you're not watching, they could steal important information or mess up your business operations.
Free. Save your status, tasks and notes.
Why it matters
If unused IT equipment or removable media aren't secured when not in use, they can be stolen or accessed, leading to data exposure and disruption.
How to implement
Managers should ensure staff know where to store equipment: Hold a short training session to show employees the designated secure storage areas like locked cabinets or secure rooms.
Use clear signage and reminders around the office to reinforce the practice.
IT teams should label and log equipment: Create a simple log of all IT equipment that includes who it's assigned to and where it should be stored when not in use.
Use asset tags on devices to make tracking easier and do regular checks to ensure devices are where they should be.
Office managers should install locks on storage areas: Recognise areas where IT equipment is stored and fit them with secure locks.
Consider using combination or key locks and maintain a list of authorised persons who have access.
Employees should be reminded to sign out equipment: Implement a sign-out sheet or digital system for tracking who takes devices out of secure storage.
Include checking the condition of the devices upon return to ensure nothing is damaged or missing.
Procurement teams should ensure purchase of lockable storage: When buying new IT equipment or media, also consider lockable cabinets or safes to store them securely when not in use.
Prioritise highly portable or sensitive equipment like laptops and external drives.
Keep it running
Lock unused devices and removable media in secure storage (e.g., cabinets/rooms), restrict key/access lists, and audit holdings regularly to confirm they remain secured.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The equipment storage policy: Check for a document or written policy detailing how and where IT equipment and media should be stored when not in use.
Good evidence
Shows clear guidance on securing equipment with specifics on storage locations.
- Check 2 of 5What an auditor asks for
Look at
Details such as equipment ID, assigned user, and storage location.
Good evidence
Is an updated log that matches the number and type of devices on-site.
- Check 3 of 5What an auditor asks for
Good evidence
Is seeing equipment secured as per the policy, such as in locked cabinets or rooms.
- Check 4 of 5What an auditor asks for
Ask for
Employees where they store their equipment after hours or when not in use.
Good evidence
Is employees indicating secured storage according to organisational policy.
- Check 5 of 5What an auditor asks for
Look at
Procurement records: Review recent purchases for lockable storage solutions for IT equipment.
Good evidence
Includes evidence of purchasing these solutions alongside new equipment, ensuring secure storage capacity is in place.
Mappings
Closest match in ISO/IEC 27001: A.5.10, Acceptable use policies for information and assets, which this control partially meets.
ISO/IEC 27001: 6 mappings
This control partially meets A.5.10.
ISM-0161 requires organisations to ensure IT equipment and media are secured whenever they are not in use. ISO/IEC 27001:2022 Annex A 5.10 supports this by establishing acceptable use and handling rules for assets (including removable media), which can mandate behaviours like secure storage, not leaving devices unattended, and following secure handling procedures. Annex A 5.10 is policy/governance-oriented and broader, while ISM-0161 is a specific physical security outcome for unused equipment/media.
This control partially overlaps A.7.7.
ISM-0161 requires IT equipment and media to be secured when not in use, with an emphasis on preventing unauthorised access to physical assets and storage media. ISO/IEC 27001:2022 Annex A 7.7 relates by mandating clear desk and clear screen rules, including secure handling of removable storage media when unattended. Annex A 7.7 also covers information visibility on screens and paper handling, while ISM-0161 is broader across all unused IT equipment and media regardless of desk/screen context.
This control partially overlaps A.7.8.
ISM-0161 requires IT equipment and media to be physically secured when not in use to prevent unauthorised access. ISO/IEC 27001:2022 Annex A 7.8 relates by requiring equipment to be sited securely and protected, which helps ensure devices and attached media are not easily accessed or removed when unattended. However, Annex A 7.8 is broader around environmental and placement protections, while ISM-0161 is specifically about securing unused equipment/media (e.g., storage, locking, preventing opportunistic access).
This control partially overlaps A.7.9.
Annex A 7.9 requires that off-site assets be protected against loss, theft, or damage. ISM-0161 mandates IT equipment and media be secured when not in use, a practical control that directly enhances the protection of laptops, removable media, and other items off-site. ISM-0161 supports Annex A 7.9 but does not cover broader off-site risks like in-transit controls.
This control partially overlaps A.7.14.
ISM-0161 requires IT equipment and media to be secured when not in use to prevent unauthorised access. ISO/IEC 27001:2022 Annex A 7.14 overlaps by addressing secure disposal or re-use of equipment containing storage media, ensuring data is removed or overwritten when equipment leaves service. ISM-0161 is about safeguarding assets during periods of non-use, whereas Annex A 7.14 is about end-of-life and transition controls rather than day-to-day physical security.
This control partially overlaps A.8.1.
ISM-0161 requires physical security for unused IT equipment and media to prevent unauthorised access. ISO/IEC 27001:2022 Annex A 8.1 overlaps by requiring protection of user endpoint devices, which commonly includes controls like locking devices away when unattended and preventing unauthorised physical access. Annex A 8.1 extends beyond physical security into technical protections (configuration, access control, encryption), while ISM-0161 is focused on securing the equipment/media when not in use.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.