ASD ISM 1598 Inspect IT equipment post-maintenance for unauthorised changes
What it says
Following maintenance or repairs to IT equipment, it is inspected to confirm that it retains its approved configuration and that no unauthorised modifications have been made.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAfter maintenance, check IT equipment to ensure no unapproved changes were made.
Whenever your IT equipment is fixed or serviced, it's crucial to check that no unauthorised changes were made. This is important because unauthorised changes can introduce vulnerabilities or unwanted software, risking your business's security and privacy.
Free. Save your status, tasks and notes.
Why it matters
Unauthorised changes to IT equipment can lead to security breaches, compromising sensitive data and disrupting business operations.
How to implement
IT team should establish a checklist: Create a checklist of key configuration settings for each piece of IT equipment to compare before and after maintenance.
Ensure configurations match approved settings.
Designate a responsible staff member: Have a specific person responsible for inspecting equipment after any external repairs.
This person should be familiar with what configurations are authorised.
Use system logs: Encourage the IT team to review system logs for unexpected changes immediately after maintenance.
Logs can indicate if unauthorised software was installed.
Engage a trusted external party: If maintenance is performed by outsiders, consider hiring a trusted IT consultant to verify no unauthorised changes were made post-maintenance.
Document inspection process: Create a simple report form for documenting each post-maintenance inspection.
Ensure it logs who performed the check, date, time, and findings.
Keep it running
Regularly update your equipment checklist to reflect authorised settings. Ensure post-maintenance inspections are thorough and consistent.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the checklist of approved configurations: Request the document used for pre- and post-maintenance checks.
Look at
whether it covers all critical settings.
Good evidence
will be a comprehensive and up-to-date list.
- Check 2 of 5What an auditor asks for
Ask for
recent inspection reports: Review reports from the last few maintenance checks.
Look at
details of the checks, including dates and personnel.
Good evidence
is a series of reports showing who did what, when.
- Check 3 of 5What an auditor asks for
Ask for
system log reviews: Request logs that show checks for unauthorised changes after maintenance.
Look at
logs close to the maintenance event.
Good evidence
shows logs reviewed with no anomalies.
- Check 4 of 5What an auditor asks for
Ask for
maintenance provider records: Request records of who performed maintenance.
Look at
signed agreements on post-service checks.
Good evidence
is documentation of authorised vendors and agreed procedures.
- Check 5 of 5What an auditor asks for
Ask for
evidence of training: Request info on who is trained to perform post-maintenance checks.
Look at
training materials and attendance records.
Good evidence
includes recent training sessions covering equipment inspection.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.9.
ISM-1598 requires IT equipment to be inspected after maintenance or repair to confirm it still matches the approved configuration and has no unauthorised modifications. Annex A 8.9 requires configurations for hardware, software, services and networks to be established, documented, implemented, monitored and reviewed, which provides the baseline and governance that post-maintenance inspection validates against. ISM-1598 is a specific checkpoint/control activity within a broader configuration management lifecycle described by Annex A 8.9.
This control partially overlaps A.7.13.
ISM-1598 requires inspection of IT equipment after maintenance/repair to ensure integrity of the approved configuration and identify unauthorised modifications. Annex A 7.13 requires equipment to be maintained correctly to ensure availability, integrity and confidentiality, which includes ensuring maintenance is performed in a way that does not introduce security weaknesses. They overlap because post-maintenance inspection is a practical measure that supports correct maintenance outcomes, but Annex A 7.13 is broader and does not explicitly require configuration verification after maintenance.
This control partially overlaps A.8.32.
ISM-1598 requires verifying, after maintenance, that IT equipment retains its approved configuration and has not been changed without authorisation. Annex A 8.32 requires changes to information systems to be controlled via change management procedures, which reduces the likelihood of unauthorised or undocumented post-maintenance changes. They overlap in controlling and detecting configuration changes, but Annex A 8.32 focuses on governing and approving change, while ISM-1598 focuses on post-activity inspection to confirm the end state.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.