ASD ISM 0305 On-site IT equipment maintenance by cleared technicians
What it says
Maintenance or repairs of IT equipment are carried out on site by an appropriately cleared technician.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure IT equipment maintenance is done onsite by technicians with proper clearance.
This rule means that whenever your IT gear needs fixing or servicing, it must be done on site by someone with the right security clearance. This matters because bringing IT equipment off-site or leaving it with an unauthorised person could risk exposing sensitive information or lead to data breaches.
Free. Save your status, tasks and notes.
Why it matters
Without this control, sensitive data might be exposed through unmonitored equipment handovers, leading to data breaches.
How to implement
IT Manager should check staff qualifications: Ensure all technicians working on IT maintenance are vetted and have proper security clearance for handling sensitive information.
Procurement Officer should update service contracts: Make sure contracts with IT service providers specify that maintenance will occur on site by cleared personnel.
Office Manager should set up a secure maintenance area: Designate a secure space where IT equipment can be worked on without risking data exposure.
HR should verify technician clearances regularly: Keep a current record of each technician's security clearance status to ensure compliance.
IT Lead should establish a maintenance log: Record each maintenance session, noting the technician's name, clearance level, and equipment serviced for future audits.
Keep it running
Ensure regular updates and checks on technician clearances and maintain precise records of all IT service activities as part of ongoing compliance.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
technician clearance records: Request HR documents or background checks showing the security clearance each technician holds.
- Check 2 of 5What an auditor asks for
Ask for
service contracts: Verify that contracts with third-party providers include on-site maintenance clauses by cleared personnel.
- Check 3 of 5What an auditor asks for
Ask for
the maintenance log: Examine entries to ensure they include technician names, clearance level, and details of the work done.
- Check 4 of 5What an auditor asks for
Ask for
the office layout plan.
Look at
the designation of the secure maintenance area, ensuring it's isolated from public access.
- Check 5 of 5What an auditor asks for
Ask for
incident reports: Check for any records of unauthorised access or breaches related to IT maintenance to ensure past compliance.
Mappings
Closest match in ISO/IEC 27001: A.7.13, Proper maintenance of equipment, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.13.
ISM-0305 requires maintenance and repairs of IT equipment to be performed on-site by an appropriately cleared technician to manage security risks from handling equipment. Annex A 7.13 requires equipment to be maintained correctly to protect availability, integrity and confidentiality, which includes establishing secure maintenance practices. ISM-0305 is a specific, higher-assurance maintenance handling requirement (on-site + clearance) whereas Annex A 7.13 is broader and does not require on-site servicing or cleared personnel.
This control partially overlaps A.5.21.
ISM-0305 requires organisations to ensure maintenance and repairs occur on-site and are performed by appropriately cleared technicians, reducing supply chain and insider risks during servicing. Annex A 5.21 addresses managing information security risks associated with the ICT supply chain, including third-party service providers involved in support and maintenance. They overlap where maintenance is outsourced or vendor-supported, but Annex A 5.21 is broader across the full supply chain lifecycle, while ISM-0305 mandates a specific control for how maintenance is executed.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.