ASD ISM 0588 Develop and maintain MFD usage policy
What it says
An MFD usage policy is developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEstablish a policy to guide the proper use of multifunction devices.
This control is about creating and keeping up-to-date a set of guidelines on how to properly use machines like printers and scanners, known as multifunction devices or MFDs. This is important because without clear rules, people might use these devices in ways that could accidentally leak sensitive information or cause security risks.
Free. Save your status, tasks and notes.
Why it matters
Improper MFD use can leak sensitive data via unattended prints, insecure scan-to-email settings, or unauthorised local storage, risking data breaches.
How to implement
Office Manager should develop the MFD usage policy: Start by listing out what functions your devices can perform, like printing, scanning, and copying.
Then, clearly describe how these functions should be used responsibly by staff, including securing documents and properly disposing of sensitive materials.
IT team should implement access controls: They need to set up the devices so only authorised users can access certain functions.
This can include setting up user accounts or card access systems for the MFDs to keep unauthorised people from using them.
HR should train staff on the policy: Develop a training program that explains the MFD usage policy and why it's necessary.
Use real-life examples of what can go wrong if the policy is not followed to help staff understand its importance.
Procurement should ensure secure MFDs: When buying new devices, check that they have security features that match the policy requirements.
Talk to vendors about your security needs to ensure they suggest devices that fit your policy.
Compliance Officer should regularly review the policy: Schedule reviews every six months to ensure the policy remains relevant.
Update the policy to reflect any changes in technology or company operations and ensure staff are informed about these updates.
Keep it running
Maintain an MFD usage policy: enforce secure defaults, restrict address books, review scan destinations, require secure release printing, and keep firmware updated.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The current MFD usage policy document: Request to see the latest version of the policy that governs MFD usage.
Look at
Detailed guidelines on proper usage, access controls, and updates from previous policies.
Good evidence
Is a policy that is comprehensive and dated within the last six months.
- Check 2 of 5What an auditor asks for
Ask for
Training records: Request evidence that staff have been trained on MFD usage policy.
Look at
Attendance records or training confirmation emails.
Good evidence
Shows that all staff have undergone training within the past year.
- Check 3 of 5What an auditor asks for
Ask for
Access control settings: Request a demo of the access control settings on the devices. Look to see if only authorised users have access to critical functions.
Good evidence
Demonstrates that access is restricted according to the policy.
- Check 4 of 5What an auditor asks for
Ask for
Procurement records for recent MFD purchases: Review documents to confirm the security features were considered in the procurement process.
Look at
Vendor contracts or purchase agreements that specify security features.
Good evidence
Confirms that security was a key consideration in purchasing decisions.
- Check 5 of 5What an auditor asks for
Ask for
Policy review logs: Check the records of when and how the policy was last reviewed and updated.
Look at
Documentation showing review dates and participants.
Good evidence
Has a recent review with documented minutes and action items.
Mappings
Closest match in ISO/IEC 27001: A.5.1, Policies for information security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.1.
ISM-0588 requires a specific topic policy for the use of multifunction devices to be developed, implemented and maintained. Annex A 5.1 requires information security and topic-specific policies to be defined, approved, communicated, acknowledged and reviewed at planned intervals. ISM-0588 fits as one example of a topic-specific policy under Annex A 5.1, but Annex A 5.1 is broader in governance and lifecycle requirements for all policies.
This control partially meets A.5.10.
Annex A 5.10 requires documented and implemented rules for acceptable use and handling of information and other assets. ISM-0588 relates by requiring an MFD usage policy, addressing acceptable use and handling risks specific to multifunction devices that process, store, or transmit information. ISM-0588 is narrower in scope (MFDs), while Annex A 5.10 covers acceptable use across all asset categories and usage contexts.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.