Skip to content
Evaluated products
ASD ISMISM-0286

ASD ISM 0286 Consult ASD for high assurance IT delivery procedures

What it says

When procuring high assurance information technology (IT) equipment, ASD is contacted for any equipment-specific delivery procedures.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Contact ASD for delivery procedures when buying high-security IT equipment.

When you're buying high-security IT equipment, it's crucial to contact the Australian Signals Directorate (ASD) for specific delivery instructions. This matters because without following proper procedures, sensitive technology could be intercepted or tampered with during delivery, which could lead to data breaches or compromised systems.

Why it matters

If ASD delivery procedures aren't consulted for high assurance IT procurements, equipment may be intercepted or tampered with before receipt.

How to implement

  1. Procurement managers should contact ASD: Reach out to the Australian Signals Directorate when planning to buy high-security IT equipment.

    Make sure you do this as early as possible in the procurement process to understand any special handling or delivery instructions.

  2. IT team should document delivery procedures: After contacting ASD, the IT team should write down the recommended procedures.

    Keep these documents handy to ensure everyone involved in receiving the equipment follows the right steps.

  3. The finance department should coordinate with suppliers: Ensure any contracts or purchase orders include references to the ASD's delivery requirements.

    This guarantees suppliers are aware and can comply with necessary security measures during shipping.

  4. Security officers should monitor deliveries: Arrange for security personnel to be present when the delivery arrives.

    They should check that the equipment package is sealed and undamaged, following all ASD guidelines.

  5. System owners should ensure secure storage: Once received, IT equipment should immediately go to a secure location.

    This prevents unauthorised access until the equipment can be properly installed and configured.

Keep it running

Before delivery of high assurance IT equipment, contact ASD and follow any equipment-specific delivery/chain-of-custody procedures provided.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    ASD communication records: Request emails or letters sent to or received from the ASD regarding delivery procedures.

    Look at

    Detailed instructions or confirmations.

    Good evidence

    Is clear communication showing the specific delivery advice from the ASD.

  2. Check 2 of 5What an auditor asks for

    Good evidence

    Is a comprehensive, clear set of instructions tailored to the specific equipment.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Them about how they informed suppliers of the special delivery requirements.

    Look at

    Consistency and awareness of the ASD's guidelines.

    Good evidence

    Is a clear description of the communication process with suppliers.

  4. Check 4 of 5What an auditor asks for

    Look at

    Adherence to the documented ASD instructions.

    Good evidence

    Is observing all steps being taken as per the guidance.

  5. Check 5 of 5What an auditor asks for

    Look at

    Evidence of restricted access.

    Good evidence

    Shows that only authorised personnel accessed the equipment.

Mappings

Closest match in ISO/IEC 27001: A.5.21, Managing information security in the ICT supply chain, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.5.21Managing information security in the ICT supply chainPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.