Skip to content
Evaluated products
ASD ISMISM-0290

ASD ISM 0290 Secure configuration of high assurance IT equipment

What it says

High assurance IT equipment is installed, configured, administered and operated in an evaluated configuration and in accordance with ASD guidance.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure high-grade IT gear is set up and operated per ASD standards for security.

This control is about ensuring that any high-grade IT equipment in your organisation is set up and used following the standards set by the Australian Signals Directorate (ASD). This matters because if the equipment isn't configured properly, it could lead to security vulnerabilities, making it easier for hackers to access sensitive information or disrupt your operations.

Why it matters

If high assurance equipment is not operated in its evaluated configuration, security claims may not hold, enabling compromise of protected information and services.

How to implement

  1. The IT team should ensure all high assurance IT equipment is installed according to the guidance from the Australian Signals Directorate (ASD).

    They can do this by carefully reading the ASD's detailed setup instructions and following each step when setting up new equipment.

  2. The procurement team should check that any high assurance IT equipment they purchase is ASD-certified for evaluated configurations.

    They can do this by consulting the ASD's Evaluated Products List (EPL) before making any purchase decisions.

  3. System administrators should periodically review the configuration of high assurance IT equipment.

    They should compare the current settings to those in the ASD guidelines and update them if there are any discrepancies.

  4. Managers should regularly schedule training for staff who manage high assurance equipment to ensure they understand ASD requirements and know how to implement them.

    This can be done through workshops or online training sessions.

  5. The organisation's leadership should ensure that there is a policy in place requiring all high assurance IT equipment to be configured as per ASD guidance before being put into operation.

    This policy should be documented and communicated clearly to relevant staff.

Keep it running

Regularly confirm the device matches its evaluated build (firmware, patches, settings); disable non-evaluated functions and tightly restrict admin access per ASD guidance.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The equipment configuration documentation: Request the setup manuals or guides used by IT staff during installation.

    Look at

    Whether the documents are based on ASD guidelines.

    Good evidence

    Shows that the documented steps match ASD's evaluated configurations.

  2. Check 2 of 5What an auditor asks for

    Good evidence

    Is that all equipment in use appears on the ASD's list of approved products.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Them how they ensure configurations are compliant with ASD guidelines.

    Good evidence

    Is that they can describe specific ASD-required configurations and demonstrate familiarity with ASD standards.

  4. Check 4 of 5What an auditor asks for

    Good evidence

    Setup follows ASD guidelines comprehensively without shortcuts.

  5. Check 5 of 5What an auditor asks for

    Good evidence

    Includes recent training sessions attended by staff, especially those directly involved with high assurance equipment.

Mappings

Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which partially overlaps with this control.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.9Configuration management for secure IT systemsPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.