Skip to content
Information technology equipment
ASD ISMISM-0321

ASD ISM 0321 Contact ASD for guidance on secure IT disposal

What it says

When disposing of IT equipment that has been designed or modified to meet emanation security standards, ASD is contacted for requirements relating to its disposal.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure secure disposal of certain IT equipment by consulting the ASD for requirements.

When it's time to get rid of old IT gear, especially if it's been specially secured against electronic spying, you need to ask the Australian Signals Directorate (ASD) for advice on how to do it safely. This matters because if equipment isn't properly disposed of, sensitive information could be leaked, potentially harming the organisation and breaching privacy laws.

Why it matters

Not contacting ASD before disposing of emanation-secure IT equipment may enable compromise of classified information or EMSEC design details.

How to implement

  1. IT managers should identify any IT equipment designed or modified to meet high-security standards.

    They can do this by checking inventory records or asset registers for equipment with security labels or documentation. They should list these items for special disposal procedures.

  2. The security officer should contact the Australian Signals Directorate (ASD) before disposing of equipment.

    They can reach out via email or phone with details of the equipment needing disposal. It's crucial to get specific guidance on the approved disposal method.

  3. Personnel responsible for IT disposal should keep detailed records of any guidance from the ASD.

    They should document the advice received and the actions taken, ensuring compliance with any specific instructions provided.

  4. The IT team should organise secure disposal methods as recommended by the ASD.

    This could involve specialised recycling services or secure destruction processes to ensure data cannot be recovered.

  5. Managers should train relevant staff about the need for secure disposal and demonstrate compliance with ASD guidelines.

    Regular training sessions or briefings can be conducted to update staff on the latest standards and procedures.

Keep it running

Before disposing of IT equipment designed/modified for emanation security, contact ASD to confirm disposal requirements and approved handling steps.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The list of IT equipment identified for special disposal.

    Look at

    Assets that meet security standards and require ASD consultation.

    Good evidence

    Includes a comprehensive list with names and security classification details.

  2. Check 2 of 5What an auditor asks for

    Good evidence

    Shows clear instructions from ASD and evidence that the advice was followed.

  3. Check 3 of 5What an auditor asks for

    Look at

    The steps taken to comply with ASD instructions.

    Good evidence

    Includes dates, methods used, and confirmation of secure disposal.

  4. Check 4 of 5What an auditor asks for

    Ask for

    How they determine when to contact ASD and how they ensure compliance.

    Good evidence

    Includes confident descriptions of the process and specific examples.

  5. Check 5 of 5What an auditor asks for

    Good evidence

    Includes documentation of steps like secure destruction methods or third-party certificates.

Mappings

Closest match in ISO/IEC 27001: A.7.14, Secure disposal or re-use of equipment, which partially overlaps with this control.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.7.14Secure disposal or re-use of equipmentPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.