ASD ISM 0336 Develop and maintain networked IT equipment register
What it says
A networked IT equipment register is developed, implemented, maintained and regularly verified.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeep a regularly checked list of IT equipment connected to the network.
It's important to keep a list of all computers and devices that are plugged into your network. This is crucial because if you don't know what's connected, you can't protect it. Hackers could exploit unsecured devices to access private information or disrupt your operations.
Free. Save your status, tasks and notes.
Why it matters
Without a current register, unidentified devices can provide entry points for cyberattacks, risking data breaches and operational disruptions.
How to implement
The IT manager should start by listing all the devices, like computers, printers, and mobile phones, that are connected to the network.
Use a simple spreadsheet or digital tool to create this inventory.
The office administrator should regularly update this list every month to reflect new or removed devices.
Keep track of equipment purchases and disposals to ensure accuracy.
The IT team must label and document network details, such as IP addresses and device types, for each item in the register.
This helps quickly identify and secure any potential vulnerabilities.
The IT manager should set up routine checks, such as quarterly audits, to verify that the equipment list is up to date and matches the actual devices connected to the network.
The business owner should review this list during regular team meetings to ensure everyone understands its importance for the security and smooth running of the business.
Keep it running
Regular updates and audits of the IT equipment register ensure new devices are swiftly secured and potential risks are minimised.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the current networked IT equipment register.
Look at
Check it is complete, with each device's type, location and details such as IP addresses recorded.
Good evidence
The register is current and contains no discrepancies or missing devices.
- Check 2 of 5What an auditor asks for
Ask for
Request evidence of regular updates to the equipment register, such as monthly change records.
Look at
Check for documented changes, including equipment that has been added and equipment that has been removed.
Good evidence
The change records show the register is actively maintained rather than a one-off document.
- Check 3 of 5What an auditor asks for
Ask for
Ask for records of regular checks or audits of the equipment register, for example quarterly verifications.
Look at
Confirm each verification is logged and note any discrepancies it identified.
Good evidence
Verifications are logged on a regular cadence and any discrepancies found were corrected promptly.
- Check 4 of 5What an auditor asks for
Ask for
Request the procedure document describing how new devices are added to the register.
Look at
Check it sets out a clear process for recording device details within a short timeframe of a device joining the network, and that the process is followed in practice.
Good evidence
The procedure is clear, in use, and new devices appear in the register soon after they connect.
- Check 5 of 5What an auditor asks for
Ask for
Ask for meeting minutes where the register is reviewed and discussed.
Look at
Look for discussion of the register's accuracy and any planned improvements.
Good evidence
The minutes record action points and review decisions about the register.
Mappings
Closest match in ISO/IEC 27001: A.5.9, Inventory management of information and associated assets, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.9.
Annex A 5.9 requires developing and maintaining an inventory of information and associated assets, including ownership. ISM-0336 (Maintain a Comprehensive IT Equipment Register) overlaps by requiring a maintained register of networked IT equipment. It is foundational but limited to IT equipment.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.4.5.
Annex A 4.5 requires the organisation to document the system and computing resources utilised for each AI system. ISM-0336 requires a maintained and regularly verified register of networked IT equipment, which directly provides documented evidence of servers, appliances and other equipment that can constitute the compute environment an AI system runs on. ISM-0336 is enterprise-wide and equipment-centric, while Annex A 4.5 is AI-system-centric and expects the documented resources to be explicitly associated with the relevant AI system(s) (including non-equipment resources such as logical environments).
ASD Essential Eight: 2 mappings
This control partially overlaps E8-PA-ML1.1.
E8-PA-ML1.1 requires an automated method of asset discovery at least fortnightly to identify assets for subsequent vulnerability scanning. ISM-0336 requires a networked IT equipment register to be developed, implemented, maintained and verified regularly. They overlap in maintaining awareness of organisational assets, but E8-PA-ML1.1 is a technical discovery activity with a defined cadence and scanning purpose, while ISM-0336 is a broader governance record-keeping requirement that may be manual and is not explicitly tied to vulnerability scanning.
This control supports E8-PO-ML1.1.
ISM-0336 requires organisations to keep an accurate, verified register of network-connected IT equipment. E8-PO-ML1.1 requires automated asset discovery at least fortnightly to support vulnerability scanning, which helps surface devices that should be captured in the equipment register and assists in verifying completeness. The candidate control is focused on discovery for patching/vulnerability outcomes, whereas ISM-0336 is focused on maintaining an authoritative inventory register as a standing control.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.