Skip to content
Information technology equipment
ASD ISMISM-0293

ASD ISM 0293 Classify IT equipment by data sensitivity

What it says

IT equipment is classified based on the highest sensitivity or classification of data that it is approved for processing, storing or communicating.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Label IT equipment based on the sensitivity of the data it handles.

This control is about making sure that your computers, phones, and other IT gadgets are set up to handle the level of sensitive data they work with. If not done right, there's a risk that sensitive information could be exposed, leading to breaches of trust, legal problems, and financial loss.

Why it matters

If equipment is classified below the data it handles, sensitive data may be stored or transmitted on unsuitable devices, increasing disclosure risk.

How to implement

  1. IT personnel should review each piece of IT equipment to determine the most sensitive type of data it can process.

    They can do this by listing all data types each device handles and checking if the equipment is suitable for its sensitivity level.

  2. Managers should assign a classification to each device based on the data it handles.

    This could be as simple as using coloured stickers that represent different levels of sensitivity, like green for public data and red for highly sensitive data.

  3. System administrators need to ensure that all devices are labelled correctly according to their data sensitivity level.

    They can achieve this by creating a checklist for labelling devices during their initial setup or regular maintenance.

  4. The IT team should provide training sessions for staff so they understand what the classifications mean and how to handle devices according to their sensitivity.

    This could be a quick briefing during team meetings or part of an onboarding program.

  5. Office managers should keep a record of all equipment classifications in an accessible document.

    This helps in regularly verifying and updating device statuses as data sensitivity requirements change.

Keep it running

Classify each device to the highest data sensitivity it is approved to process/store/transmit, and update labels/records when approvals or usage change.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The IT equipment classification register: Request a document or spreadsheet listing all IT equipment and their assigned data sensitivity levels.

    Look at

    Consistency in classification methods.

    Good evidence

    Is a detailed register with classifications matched to device types.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Them how they identify the data sensitivity level of the equipment they use.

    Good evidence

    Is staff describing clear procedures for identifying classified devices and understanding what each classification means.

  3. Check 3 of 5What an auditor asks for

    Look at

    Devices to confirm they are labelled according to the register details.

    Good evidence

    Is seeing a variety of labelled equipment that conforms with documented data sensitivity levels.

  4. Check 4 of 5What an auditor asks for

    Good evidence

    Is a policy that aligns with best practices like those advised by the Australian Signals Directorate (ASD).

  5. Check 5 of 5What an auditor asks for

    Ask for

    Records of attendance and session content.

    Good evidence

    Is a list of recent training sessions, participant names, and a summary of covered topics pertinent to equipment classification.

Mappings

Closest match in ISO/IEC 27001: A.5.13, Labelling of information, which partially overlaps with this control.

ISO 27001

ISO/IEC 27001: 2 mappings

  • A.5.13Labelling of informationPartially overlaps
  • A.5.12Information classification policy and practicesDepends on

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.