ASD ISM 0294 Label IT equipment with sensitivity markings
What it says
IT equipment, except for high assurance IT equipment, is labelled with protective markings reflecting its sensitivity or classification.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishLabel IT equipment, except high assurance, with appropriate sensitivity or classification markings.
It's important to label IT equipment, apart from high-security items, with how sensitive the information on it is. If we don't, we risk losing control of private data, which could lead to legal troubles, financial loss, or harm to our reputation.
Free. Save your status, tasks and notes.
Why it matters
Unlabelled IT equipment can lead to data leaks, causing legal issues, financial loss, and damage to reputation.
How to implement
The IT team should create a list of all equipment that needs sensitivity labels.
They can identify devices like computers, servers, and even tablets that store or process sensitive information.
Managers must assign labels to each piece of equipment based on the type of data it holds.
They can use categories like 'Confidential' or 'Internal Use Only' to reflect the sensitivity.
Procurement staff should ensure new equipment comes pre-labelled or ready for labelling.
They can specify this requirement when ordering new gear.
IT support should regularly check and update the labels as data classification changes.
This involves physically inspecting the equipment to ensure the labels are current and correct.
HR should train staff on recognising and respecting these labels to maintain information security.
This can be done through workshops or regular briefings on security policies.
Keep it running
Regular checks are essential to ensure all IT equipment maintains its correct sensitivity labels, avoiding data mishandling.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
an inventory of all IT equipment with their sensitivity labels.
Look at
the completeness and classification of each item.
Good evidence
example has a current list with each item marked according to sensitivity guidelines.
- Check 2 of 5What an auditor asks for
Good evidence
is a clear process with roles and detailed instructions.
- Check 3 of 5What an auditor asks for
Look at
attendance and comprehension of training sessions.
Good evidence
shows regular training with updated materials.
- Check 4 of 5What an auditor asks for
Ask for
recent inspection reports of labelled equipment.
Look at
the dates and findings regarding label accuracy and visibility.
Good evidence
includes a recent checklist confirming labels are correct.
- Check 5 of 5What an auditor asks for
Look at
detailed entries documenting reasons for changes.
Good evidence
logs the date, reason, and person responsible for each update.
Mappings
Closest match in ISO/IEC 27001: A.5.13, Labelling of information, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.13.
ISM-0294 requires organisations to label IT equipment (excluding high assurance equipment) with protective markings that reflect the equipment's sensitivity or classification. ISO/IEC 27001:2022 Annex A 5.13 establishes the organisation-wide procedures for information labelling aligned to an information classification scheme, which is the governance basis used to determine what protective marking should appear on equipment labels. Annex A 5.13 focuses on labelling information assets/content, while ISM-0294 is a specific physical implementation for equipment labelling using protective markings.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.