ASD ISM 1551 Develop and maintain IT equipment management policy
What it says
An IT equipment management policy is developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOrganisations must create and sustain a policy for managing IT equipment.
Having a policy to manage your IT equipment is like creating a rulebook for all the computers, printers, and other tech gear in your organisation. It ensures everyone knows how to properly use, care for, and replace equipment. Without it, you risk damaged devices, wasted money, and security breaches that could harm your business operations.
Free. Save your status, tasks and notes.
Why it matters
Without an IT equipment management policy, devices can go untracked, increasing loss/theft risk, data exposure, and service disruption.
How to implement
The office manager should draft an IT equipment policy.
This involves listing all types of equipment, defining their proper use, maintenance schedules, and replacement procedures. Use a simple document template to ensure all key aspects are covered.
The IT team should review the draft policy.
They can provide expertise on technical specifications and necessary security measures. This can be done in a meeting where they go through the draft and suggest enhancements.
Management should approve the policy.
This involves reading through the document and ensuring it aligns with business goals and budget constraints. They should also sign off on it to formally enforce the policy.
The HR team should integrate the policy into employee onboarding.
They need to ensure new staff receive the policy and understand it. This can be done by including it in the induction pack and running a short briefing session.
All staff should receive training on the policy.
Regular workshops or online training sessions should be set up to explain the policy in detail. This helps to make sure everyone knows how to follow the rules and why doing so is important.
Keep it running
Maintain a current IT equipment register (owner, location, status, disposal) and reconcile it regularly to quickly identify missing or unauthorised devices.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The written IT equipment management policy document.
Look at
Detailed sections on types of equipment, usage guidelines, maintenance, and replacement procedures.
Good evidence
Policy will be comprehensive, easy to understand, and updated within the last year.
- Check 2 of 5What an auditor asks for
Look at
Whether all items are accounted for and matched to the usage guidelines in the policy.
Good evidence
List will show each item's current status and last inspection date.
- Check 3 of 5What an auditor asks for
Ask for
Maintenance records for IT equipment.
Look at
Entries that match the policy's maintenance schedule and details on any repairs or issues. A well-maintained record will have regular, complete logs showing prompt resolution of issues.
- Check 4 of 5What an auditor asks for
Look at
Attendance records and training materials that align with the policy details.
Good evidence
Training record will cover all staff and regularly update their knowledge.
- Check 5 of 5What an auditor asks for
Ask for
Management approval records of the policy.
Look at
Signatures or approval dates from upper management.
Good evidence
Shows that management has reviewed and sanctioned the policy, reflecting their commitment to its enforcement.
Mappings
Closest match in ISO/IEC 27001: A.5.1, Policies for information security, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.1.
ISM-1551 requires an organisation to develop, implement and maintain a specific topic policy for IT equipment management. Annex A 5.1 requires the organisation to define, approve, publish, communicate, acknowledge and review information security policy and topic-specific policies, providing overarching governance for how such policies are managed. ISM-1551 is a specific instance of the topic-specific policy concept in Annex A 5.1, focused on equipment management content rather than enterprise policy governance.
This control partially overlaps A.5.10.
ISM-1551 requires an organisation to maintain an IT equipment management policy to govern how IT equipment is handled and controlled. Annex A 5.10 requires acceptable use rules and handling procedures for information and associated assets, which overlaps with equipment management where acceptable use, custody, and handling of devices are defined. ISM-1551 is broader across the equipment lifecycle (e.g., allocation, maintenance, disposal), while Annex A 5.10 also covers information handling beyond equipment.
This control depends on A.5.9.
Annex A 5.9 requires developing and maintaining an inventory of information, associated assets, and owners. ISM-1551 (Develop and Maintain IT Equipment Management Policy) supports this by establishing policies governing equipment identification, recording, ownership, and maintenance. However, ISM-1551 is policy-focused and does not explicitly define a complete asset inventory.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.