ASD ISM 0296 Approval required for high assurance IT equipment labelling
What it says
ASD's approval is sought before applying labels to external surfaces of high assurance IT equipment.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSeek approval before labelling high assurance IT equipment to ensure security standards.
Before putting labels on high-security IT equipment, you need to get approval from the Australian Signals Directorate (ASD). This is vital because incorrect labelling can lead to security risks, such as equipment being misused or targeted by cyber attackers.
Free. Save your status, tasks and notes.
Why it matters
Applying labels to external surfaces without ASD approval may reveal device assurance level, increasing targeting and risking compromise.
How to implement
IT staff should identify equipment that requires high assurance labelling.
Make a list of your IT equipment and determine which items are classified as high assurance by consulting organisational policy or ASD guidelines.
System owners should prepare documentation for each high assurance equipment.
Document what the equipment is, its purpose, and why it requires special labelling according to ASD standards.
The compliance officer should submit the labelling documentation to ASD for approval.
Create a formal request with all necessary paperwork and send it to ASD, making sure all arguments for labelling are clear and well-documented.
IT managers should develop a process for labelling approved equipment.
Once approval is received, devise a foolproof method for applying labels so they adhere properly and stay on securely without damaging the equipment.
Procurement officers should keep track of all labelled equipment.
Use an inventory system to ensure every piece of high assurance machinery with a label is accounted for, focusing on ensuring each label remains intact and visible.
Keep it running
Before placing any external label on high assurance IT equipment, confirm and record ASD approval and use only the approved wording/format.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The equipment labelling request submitted to ASD.
Look at
The request form or email to ensure it includes the equipment details, reasons for labelling, and the date of submission.
Good evidence
Shows all fields completed correctly and a clear reason provided for labelling.
- Check 2 of 5What an auditor asks for
Look at
Confirmation emails or letters from ASD approving the labelling.
Good evidence
Is a formal document or email showing ASD's approval with equipment details.
- Check 3 of 5What an auditor asks for
Ask for
How they ensure only ASD-approved labelling is on high assurance equipment.
Good evidence
Includes methods for verifying labelled equipment matches ASD approvals and is randomly checked regularly.
- Check 4 of 5What an auditor asks for
Good evidence
Shows labels are intact, legible, and situated in accordance with ASD guidelines.
- Check 5 of 5What an auditor asks for
Good evidence
Shows consistent records dating back to the initial approval by ASD with regular updates.
Mappings
Closest match in ISO/IEC 27001: A.5.13, Labelling of information, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.13.
ISM-0296 requires an organisation to seek ASD approval before applying any labels to the external surfaces of high assurance IT equipment, to avoid creating security risks through markings. This relates to Annex A 5.13, which requires organisations to establish and implement procedures for labelling information in line with their classification scheme, including how labels are applied and controlled. The overlap is in governance of labelling practices, but ISM-0296 is specifically about externally visible equipment labelling and an external approval step, whereas Annex A 5.13 is broader and primarily about labelling information (and associated media) rather than equipment surfaces.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.