ASD ISM 0310 Off-site IT equipment handling approvals
What it says
IT equipment maintained or repaired off site is handled at facilities approved for handling the sensitivity or classification of the IT equipment.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOff-site IT repairs must be at approved facilities matching the equipment's classification level.
This control ensures that any IT equipment you send off-site for repairs goes to a place that's approved to handle its sensitive information. If this doesn't happen, your business could accidentally leak confidential data, leading to financial loss or trust issues with clients.
Free. Save your status, tasks and notes.
Why it matters
If improper facilities handle repairs, sensitive data can leak, compromising customer trust and violating privacy laws.
How to implement
The IT manager should create a list of approved repair facilities.
Begin by identifying facilities that have the necessary security certifications for handling your equipment's classification level.
The procurement team should ensure contracts with repair facilities include clauses about handling sensitive data.
They should work with legal advisors to draft these terms clearly and ensure they cover all security requirements.
Office managers should track all equipment sent for off-site repair.
Use a logbook or spreadsheet that records what was sent, where, when, and if the facility is on the approved list.
IT support staff should conduct regular checks on repair facilities to confirm compliance.
Visit facilities annually to verify that they still meet the security criteria needed for your equipment.
The compliance officer should establish a review process for repair facility approvals.
Schedule reviews at least once a year to reassess each facility's qualifications and adjust the approved list as needed.
Keep it running
Regularly update your list of approved repair facilities to ensure continued compliance with security standards.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the list of approved repair facilities: Request documentation that shows which facilities are approved to handle your IT equipment.
Look at
approval dates and notes on each one's security measures.
Good evidence
list will have up-to-date entries with clear security criteria for each facility.
- Check 2 of 5What an auditor asks for
Ask for
recent equipment repair logs: Get copies of logs that track IT equipment sent off-site.
Look at
entries that include the date sent, destination, and whether the facility is approved.
Good evidence
log will show consistent usage of approved facilities only.
- Check 3 of 5What an auditor asks for
Look at
clauses that specify data protection and confidentiality measures.
Good evidence
contract is clear and complies with your security policies.
- Check 4 of 5What an auditor asks for
Ask for
assessment reports on repair facilities: Review documents from recent checks or audits of facilities.
Look at
details on facility evaluations, security credentials, and compliance status.
Good evidence
report confirms facilities meet all needed security standards.
- Check 5 of 5What an auditor asks for
Look at
sections on facility approval criteria and review schedules.
Good evidence
policy is detailed, current, and accessible to relevant staff.
Mappings
Closest match in ISO/IEC 27001: A.7.13, Proper maintenance of equipment, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.7.13.
ISM-0310 requires that IT equipment maintained or repaired off site is handled only at facilities approved for the equipment's sensitivity or classification. Annex A 7.13 requires equipment to be maintained correctly to protect availability, integrity and confidentiality, which can include controls over who performs maintenance and where it occurs. Annex A 7.13 is broader and does not specifically mandate the use of classification-approved off-site facilities, while ISM-0310 is specifically focused on off-site repair location approval.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.