Escort Uncleared Technicians During IT Equipment Maintenance or Repairs
When a technician who lacks the required security clearance works on your IT equipment, a suitable cleared person must escort and supervise them throughout.
Plain language
Sometimes the person fixing or servicing your computers, servers or other IT equipment does not hold the security clearance (an official check that someone is trusted to access sensitive information) your organisation requires. When that happens, this control says you must have a trusted, cleared staff member stay with that technician the whole time. That escort directs the work, understands enough about the equipment to follow what is being done, protects the equipment from tampering, and makes sure no sensitive information is seen or taken.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
June 2026
Control Stack last updated
18 June 2026
E8 maturity levels
N/A
Official control statement
If an appropriately cleared technician is not used to undertake maintenance or repairs to IT equipment, the technician is escorted by someone who: - has the authority to direct the technician - is appropriately cleared and briefed - is sufficiently familiar with the IT equipment to understand the work being undertaken - takes all responsible measures to ensure the integrity of the IT equipment - takes due care to ensure that data is not disclosed.
Why it matters
An uncleared technician left unsupervised could tamper with equipment, install unauthorised devices, or copy sensitive data, leading to a data breach, downtime, and loss of trust.
Operational notes
Confirm the escort's clearance and briefing before every uncleared technician visit, and keep a log so you can show maintenance was supervised whenever required.
Implementation tips
- The IT manager should keep a short list of which maintenance and repair tasks require an appropriately cleared technician, so reception or admin staff know when an escort must be arranged before letting a technician near the equipment.
- When an uncleared technician is booked, the responsible manager should assign a named escort in advance who holds the right clearance, has been briefed on what work is happening, and has the authority to tell the technician to stop or change what they are doing.
- The escort should stay physically present with the technician for the entire visit, watching the work closely enough to understand it, and should never leave the technician alone with equipment that holds or can access sensitive data.
- The escort should take practical steps to protect the integrity of the equipment, for example checking that no extra hardware (such as a USB drive or unknown device) is plugged in, and confirming the equipment is in the same state when the technician leaves.
- The escort should make sure sensitive information is not exposed during the visit, for example by logging off screens, removing or covering sensitive documents, and stepping in if the technician tries to view or copy data that is not part of the job.
Audit / evidence tips
- Askthe procedure that explains when an uncleared technician must be escorted during IT maintenance or repairsLook atwhether it names who can act as an escort and what they must doGoodis a written procedure listing the escort's authority, clearance, familiarity with the equipment, and duty to protect equipment and data
- Askrecords of recent maintenance or repair visits by external techniciansLook atwhether each uncleared technician was matched to a named escortGoodis a visitor or maintenance log that records the technician, the escort, the date, and the work performed
- Askhow the organisation confirms an escort is appropriately cleared and briefed before a visitLook atclearance records and any briefing notesGoodshows the escort held the required clearance and was briefed on the specific work beforehand
- Askhow the escort is chosen to ensure they understand the equipment being worked onLook atthe escort's role or technical knowledgeGoodshows escorts are selected because they are familiar enough with the IT equipment to follow and direct the work
- Askwhat the escort does to protect equipment integrity and prevent data disclosure during a visitLook atchecklists or notes from real visitsGooddescribes concrete steps such as supervising continuously, checking for unauthorised devices, and ensuring no sensitive data was viewed or removed
Cross-framework mappings
How ISM-0306 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(1)expand_less | ||
| Annex A 7.2 | Annex A 7.2 requires secure areas to be protected by entry controls so only authorised people can enter | |
handshakeSupports(1)expand_less | ||
| Annex A 7.13 | Annex A 7.13 mandates correct maintenance of equipment for preserving information security | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Information technology equipment
See all Guidelines for information technology equipment controls, or browse the full ASD ISM library.