ASD ISM 0306 Escort uncleared technicians during IT equipment maintenance or repairs
What it says
If an appropriately cleared technician is not used to undertake maintenance or repairs to IT equipment, the technician is escorted by someone who: - has the authority to direct the technician - is appropriately cleared and briefed - is sufficiently familiar with the IT equipment to understand the work being undertaken - takes all responsible measures to ensure the integrity of the IT equipment - takes due care to ensure that data is not disclosed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWhen a technician who lacks the required security clearance works on your IT equipment, a suitable cleared person must escort and supervise them throughout.
Sometimes the person fixing or servicing your computers, servers or other IT equipment does not hold the security clearance (an official check that someone is trusted to access sensitive information) your organisation requires. When that happens, this control says you must have a trusted, cleared staff member stay with that technician the whole time. That escort directs the work, understands enough about the equipment to follow what is being done, protects the equipment from tampering, and makes sure no sensitive information is seen or taken.
Free. Save your status, tasks and notes.
Why it matters
An uncleared technician left unsupervised could tamper with equipment, install unauthorised devices, or copy sensitive data, leading to a data breach, downtime, and loss of trust.
How to implement
The IT manager should keep a short list of which maintenance and repair tasks require an appropriately cleared technician, so reception or admin staff know when an escort must be arranged before letting a technician near the equipment.
When an uncleared technician is booked, the responsible manager should assign a named escort in advance who holds the right clearance, has been briefed on what work is happening, and has the authority to tell the technician to stop or change what they are doing.
The escort should stay physically present with the technician for the entire visit, watching the work closely enough to understand it, and should never leave the technician alone with equipment that holds or can access sensitive data.
The escort should take practical steps to protect the integrity of the equipment, for example checking that no extra hardware (such as a USB drive or unknown device) is plugged in, and confirming the equipment is in the same state when the technician leaves.
The escort should make sure sensitive information is not exposed during the visit, for example by logging off screens, removing or covering sensitive documents, and stepping in if the technician tries to view or copy data that is not part of the job.
Keep it running
Confirm the escort's clearance and briefing before every uncleared technician visit, and keep a log so you can show maintenance was supervised whenever required.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the procedure that explains when an uncleared technician must be escorted during IT maintenance or repairs.
Look at
whether it names who can act as an escort and what they must do.
Good evidence
is a written procedure listing the escort's authority, clearance, familiarity with the equipment, and duty to protect equipment and data.
- Check 2 of 5What an auditor asks for
Ask for
records of recent maintenance or repair visits by external technicians.
Look at
whether each uncleared technician was matched to a named escort.
Good evidence
is a visitor or maintenance log that records the technician, the escort, the date, and the work performed.
- Check 3 of 5What an auditor asks for
Ask for
how the organisation confirms an escort is appropriately cleared and briefed before a visit.
Look at
clearance records and any briefing notes.
Good evidence
shows the escort held the required clearance and was briefed on the specific work beforehand.
- Check 4 of 5What an auditor asks for
Ask for
how the escort is chosen to ensure they understand the equipment being worked on.
Look at
the escort's role or technical knowledge.
Good evidence
shows escorts are selected because they are familiar enough with the IT equipment to follow and direct the work.
- Check 5 of 5What an auditor asks for
Ask for
what the escort does to protect equipment integrity and prevent data disclosure during a visit.
Look at
checklists or notes from real visits.
Good evidence
describes concrete steps such as supervising continuously, checking for unauthorised devices, and ensuring no sensitive data was viewed or removed.
Mappings
Closest match in ISO/IEC 27001: A.7.13, Proper maintenance of equipment, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.13.
Annex A 7.13 mandates correct maintenance of equipment for preserving information security. ISM-0306 supports this by requiring unauthorised or uncleared technicians to be escorted during repairs to prevent data disclosure and maintain the integrity of IT equipment. ISM-0306 is about personnel supervision during maintenance, while Annex A 7.13 is the overarching requirement for proper maintenance practices.
This control partially overlaps A.7.2.
Annex A 7.2 requires secure areas to be protected by entry controls so only authorised people can enter. ISM-0306 relates by requiring uncleared technicians to be escorted during maintenance, which is a procedural control to manage access into and within secure areas when entry must be granted. ISM-0306 is narrower and scenario-specific (maintenance by non-cleared personnel) and focuses on supervision rather than the design of entry controls at access points.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.