ASD ISM 1036 Place multifunction devices where their use can be observed
What it says
MFDs are placed in areas where their use can be observed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMultifunction devices (combined printers, scanners, copiers and fax machines) are located in open, visible areas where staff and others can see them being used.
A multifunction device, or MFD, is an office machine that combines printing, scanning, copying and often faxing in one unit. This control says you should put these machines in open areas where their use can be easily seen, rather than tucked away in private offices, store rooms or quiet corners. When people can see who is using a device and what they are doing, it is much harder for someone to quietly copy, scan or print sensitive documents without anyone noticing, which discourages misuse and helps protect your information.
Free. Save your status, tasks and notes.
Why it matters
If multifunction devices sit in hidden or quiet areas, someone can copy, scan or print sensitive documents unnoticed, leading to data theft or leaks.
How to implement
The office manager should position every multifunction device in a shared, open space such as a central work area or main corridor, rather than inside private offices, locked rooms or out-of-the-way corners where use cannot be seen.
Whoever arranges the office layout should angle each device so its screen and output tray face into the room and are visible to passing staff, avoiding spots where someone using it would have their back to everyone and the machine hidden from view.
The business owner or office manager should walk through the workplace and note any multifunction device sitting in an isolated location, then relocate it to a busier, more visible area or, if it cannot be moved, increase supervision of that spot.
When fitting out a new office or area, the person planning the floor plan should place multifunction devices in line of sight of regularly staffed desks so that day-to-day activity naturally provides oversight of who is using them.
The office manager should keep walkways and sightlines to each device clear of tall cabinets, partitions or stacked boxes so nothing blocks the view of the machine while it is in use.
Keep it running
Recheck device placement whenever the office is rearranged, staff move desks, or new multifunction devices are installed, so visibility is maintained over time.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
to see a simple floor plan or photographs showing where each multifunction device is located.
Look at
whether the devices sit in open, shared areas.
Good evidence
shows every device in a visible, frequently used space rather than in private offices or hidden corners.
- Check 2 of 5What an auditor asks for
Ask for
the office manager to walk you to each multifunction device.
Look at
whether you can see the device clearly from nearby staffed desks or walkways.
Good evidence
is that someone using the device would be easily noticed by people working nearby.
- Check 3 of 5What an auditor asks for
Ask for
how the organisation decided where to place its multifunction devices.
Look at
a deliberate reason tied to visibility and oversight.
Good evidence
references the goal of being able to observe use, not just convenience or available space.
- Check 4 of 5What an auditor asks for
Ask for
whether any device is in a low-traffic or enclosed location, and if so what is done about it.
Look at
either relocation or extra supervision.
Good evidence
shows the organisation has identified poorly placed devices and acted on them.
- Check 5 of 5What an auditor asks for
Ask for
whether furniture, partitions or storage have been kept clear of the devices.
Look at
the actual sightlines on site.
Good evidence
is that nothing blocks the view of a device while it is being used.
Mappings
Closest match in ISO/IEC 27001: A.7.8, Equipment siting and protection, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.7.8.
ISM-1036 requires multifunction devices (MFDs) to be located in areas where their use can be observed to provide day-to-day oversight and deter misuse. This relates directly to ISO/IEC 27001:2022 Annex A 7.8, which requires equipment to be sited securely and protected, including choosing locations that reduce risk. ISM-1036 is a specific, security-focused siting requirement for MFD visibility, whereas Annex A 7.8 is broader and applies to all equipment and a wider range of protection objectives.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.