On-Site IT Equipment Maintenance by Cleared Technicians
Ensure IT equipment maintenance is done onsite by technicians with proper clearance.
Plain language
This rule means that whenever your IT gear needs fixing or servicing, it must be done on site by someone with the right security clearance. This matters because bringing IT equipment off-site or leaving it with an unauthorised person could risk exposing sensitive information or lead to data breaches.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
June 2026
Control Stack last updated
18 June 2026
E8 maturity levels
N/A
Official control statement
Maintenance or repairs of IT equipment are carried out on site by an appropriately cleared technician.
Why it matters
Without this control, sensitive data might be exposed through unmonitored equipment handovers, leading to data breaches.
Operational notes
Ensure regular updates and checks on technician clearances and maintain precise records of all IT service activities as part of ongoing compliance.
Implementation tips
- IT Manager should check staff qualifications: Ensure all technicians working on IT maintenance are vetted and have proper security clearance for handling sensitive information.
- Procurement Officer should update service contracts: Make sure contracts with IT service providers specify that maintenance will occur on site by cleared personnel.
- Office Manager should set up a secure maintenance area: Designate a secure space where IT equipment can be worked on without risking data exposure.
- HR should verify technician clearances regularly: Keep a current record of each technician's security clearance status to ensure compliance.
- IT Lead should establish a maintenance log: Record each maintenance session, noting the technician's name, clearance level, and equipment serviced for future audits.
Audit / evidence tips
- Asktechnician clearance records: Request HR documents or background checks showing the security clearance each technician holds
- Askservice contracts: Verify that contracts with third-party providers include on-site maintenance clauses by cleared personnel
- Askthe maintenance log: Examine entries to ensure they include technician names, clearance level, and details of the work done
- Askthe office layout planLook atthe designation of the secure maintenance area, ensuring it's isolated from public access
- Askincident reports: Check for any records of unauthorised access or breaches related to IT maintenance to ensure past compliance
Cross-framework mappings
How ISM-0305 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 7.13 | ISM-0305 requires maintenance and repairs of IT equipment to be performed on-site by an appropriately cleared technician to manage securi... | |
sync_altPartially overlaps(1)expand_less | ||
| Annex A 5.21 | ISM-0305 requires organisations to ensure maintenance and repairs occur on-site and are performed by appropriately cleared technicians, r... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Information technology equipment
See all Guidelines for information technology equipment controls, or browse the full ASD ISM library.