Place Multifunction Devices Where Their Use Can Be Observed
Multifunction devices (combined printers, scanners, copiers and fax machines) are located in open, visible areas where staff and others can see them being used.
Plain language
A multifunction device, or MFD, is an office machine that combines printing, scanning, copying and often faxing in one unit. This control says you should put these machines in open areas where their use can be easily seen, rather than tucked away in private offices, store rooms or quiet corners. When people can see who is using a device and what they are doing, it is much harder for someone to quietly copy, scan or print sensitive documents without anyone noticing, which discourages misuse and helps protect your information.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
June 2026
Control Stack last updated
18 June 2026
E8 maturity levels
N/A
Section
Multifunction DevicesOfficial control statement
MFDs are placed in areas where their use can be observed.
Why it matters
If multifunction devices sit in hidden or quiet areas, someone can copy, scan or print sensitive documents unnoticed, leading to data theft or leaks.
Operational notes
Recheck device placement whenever the office is rearranged, staff move desks, or new multifunction devices are installed, so visibility is maintained over time.
Implementation tips
- The office manager should position every multifunction device in a shared, open space such as a central work area or main corridor, rather than inside private offices, locked rooms or out-of-the-way corners where use cannot be seen.
- Whoever arranges the office layout should angle each device so its screen and output tray face into the room and are visible to passing staff, avoiding spots where someone using it would have their back to everyone and the machine hidden from view.
- The business owner or office manager should walk through the workplace and note any multifunction device sitting in an isolated location, then relocate it to a busier, more visible area or, if it cannot be moved, increase supervision of that spot.
- When fitting out a new office or area, the person planning the floor plan should place multifunction devices in line of sight of regularly staffed desks so that day-to-day activity naturally provides oversight of who is using them.
- The office manager should keep walkways and sightlines to each device clear of tall cabinets, partitions or stacked boxes so nothing blocks the view of the machine while it is in use.
Audit / evidence tips
- Askto see a simple floor plan or photographs showing where each multifunction device is locatedLook atwhether the devices sit in open, shared areasGoodshows every device in a visible, frequently used space rather than in private offices or hidden corners
- Askthe office manager to walk you to each multifunction deviceLook atwhether you can see the device clearly from nearby staffed desks or walkwaysGoodis that someone using the device would be easily noticed by people working nearby
- Askhow the organisation decided where to place its multifunction devicesLook ata deliberate reason tied to visibility and oversightGoodreferences the goal of being able to observe use, not just convenience or available space
- Askwhether any device is in a low-traffic or enclosed location, and if so what is done about itLook ateither relocation or extra supervisionGoodshows the organisation has identified poorly placed devices and acted on them
- Askwhether furniture, partitions or storage have been kept clear of the devicesLook atthe actual sightlines on siteGoodis that nothing blocks the view of a device while it is being used
Cross-framework mappings
How ISM-1036 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(2)expand_less | ||
| Annex A 7.3 | ISM-1036 requires organisations to position MFDs so their use is observable, providing physical oversight of printing, scanning and copyi... | |
| Annex A 7.8 | ISM-1036 requires multifunction devices (MFDs) to be located in areas where their use can be observed to provide day-to-day oversight and... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Communications systems
See all Guidelines for communications systems controls, or browse the full ASD ISM library.