ASD ISM 0336Develop and Maintain Networked IT Equipment Register
Official control statement
A networked IT equipment register is developed, implemented, maintained and regularly verified.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Keep a regularly checked list of IT equipment connected to the network.
What this means in practice
It's important to keep a list of all computers and devices that are plugged into your network. This is crucial because if you don't know what's connected, you can't protect it. Hackers could exploit unsecured devices to access private information or disrupt your operations.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Proactive
Classifications
NC, OS, P, S, TS
ISM last updated
June 2026
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Section
IT equipment usageTopic
IT equipment registers
Why it matters
Without a current register, unidentified devices can provide entry points for cyberattacks, risking data breaches and operational disruptions.
Operational notes
Regular updates and audits of the IT equipment register ensure new devices are swiftly secured and potential risks are minimised.
Implementation tips
- The IT manager should start by listing all the devices, like computers, printers, and mobile phones, that are connected to the network. Use a simple spreadsheet or digital tool to create this inventory.
- The office administrator should regularly update this list every month to reflect new or removed devices. Keep track of equipment purchases and disposals to ensure accuracy.
- The IT team must label and document network details, such as IP addresses and device types, for each item in the register. This helps quickly identify and secure any potential vulnerabilities.
- The IT manager should set up routine checks, such as quarterly audits, to verify that the equipment list is up to date and matches the actual devices connected to the network.
- The business owner should review this list during regular team meetings to ensure everyone understands its importance for the security and smooth running of the business.
Audit / evidence tips
- AskAsk for the current networked IT equipment register.Look atCheck it is complete, with each device's type, location and details such as IP addresses recorded.GoodThe register is current and contains no discrepancies or missing devices.
- AskRequest evidence of regular updates to the equipment register, such as monthly change records.Look atCheck for documented changes, including equipment that has been added and equipment that has been removed.GoodThe change records show the register is actively maintained rather than a one-off document.
- AskAsk for records of regular checks or audits of the equipment register, for example quarterly verifications.Look atConfirm each verification is logged and note any discrepancies it identified.GoodVerifications are logged on a regular cadence and any discrepancies found were corrected promptly.
- AskRequest the procedure document describing how new devices are added to the register.Look atCheck it sets out a clear process for recording device details within a short timeframe of a device joining the network, and that the process is followed in practice.GoodThe procedure is clear, in use, and new devices appear in the register soon after they connect.
- AskAsk for meeting minutes where the register is reviewed and discussed.Look atLook for discussion of the register's accuracy and any planned improvements.GoodThe minutes record action points and review decisions about the register.
Cross-framework mappings
How ISM-0336 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(1)expand_less | ||
| Annex A 5.9 | Annex A 5.9 requires developing and maintaining an inventory of information and associated assets, including ownership | |
ISO 42001
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(1)expand_less | ||
| Annex A 4.5 | Annex A 4.5 requires the organisation to document the system and computing resources utilised for each AI system | |
E8
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(1)expand_less | ||
| E8-PA-ML1.1 | E8-PA-ML1.1 requires an automated method of asset discovery at least fortnightly to identify assets for subsequent vulnerability scanning | |
handshakeSupports(1)expand_less | ||
| E8-PO-ML1.1 | ISM-0336 requires organisations to keep an accurate, verified register of network-connected IT equipment | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Information technology equipment
See all Guidelines for information technology equipment controls, or browse the full ASD ISM library.