ASD ISM 1599 Proper handling of sensitive IT equipment
What it says
IT equipment is handled in a manner suitable for its sensitivity or classification.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure IT equipment is handled based on how sensitive or classified it is.
This control is about making sure that the way we handle IT equipment matches how sensitive or classified the information on it is. It's important because mishandling such equipment could lead to leaking sensitive data or compromising important systems, which can cause financial damage and hurt your organisation's reputation.
Free. Save your status, tasks and notes.
Why it matters
Improper handling of sensitive IT equipment can expose stored data or classified material during transport, storage or disposal, causing a breach.
How to implement
The IT team should classify equipment based on the data it handles.
They can use a simple system like 'high', 'medium', and 'low' sensitivity based on what kind of information the equipment accesses and stores.
Managers should establish handling protocols for each sensitivity level.
For example, highly sensitive equipment might need to be kept securely locked or have restricted access to authorised personnel only.
The procurement team should ensure that new equipment purchases align with the organisation's sensitivity handling requirements.
They can do this by referring to the sensitivity classification during the purchasing process.
Staff handling IT equipment should be trained on sensitivity levels.
This can be achieved through regular training sessions where they learn about why different handling procedures are necessary for various equipment.
The security officers should periodically review how equipment is being handled.
They can conduct spot checks and audits to ensure compliance with the established protocols for handling sensitive IT equipment.
Keep it running
Define and regularly test procedures for labelling, secure transport, controlled storage and sanitised disposal of sensitive IT equipment, with chain-of-custody.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The equipment sensitivity classification document: Request to see the list or database that classifies the organisation's IT equipment by sensitivity.
Look at
Clear categorisation and updates.
Good evidence
Consistently updated record showing all equipment with assigned sensitivity levels.
- Check 2 of 5What an auditor asks for
Ask for
Handling protocols for different sensitivity levels: Request documents detailing how equipment should be handled based on its classification.
Look at
Specific handling instructions and associated access controls.
Good evidence
A guideline document with specific handling protocols for each sensitivity category.
- Check 3 of 5What an auditor asks for
Ask for
Training records: Request evidence of staff training on handling sensitive IT equipment.
Look at
Dates and content coverage.
Good evidence
Dated training logs showing completion by relevant staff, covering the necessity and application of handling protocols.
- Check 4 of 5What an auditor asks for
Ask for
Evidence of equipment handling audits: Request recent audit reports on how IT equipment is managed.
Look at
Findings related to adherence to handling protocols.
Good evidence
Audit reports highlighting compliance levels and rectifications for any mishandlings.
- Check 5 of 5What an auditor asks for
Ask for
Access control records: Request logs related to who accesses sensitive equipment.
Look at
Any irregular activity or unauthorised access.
Good evidence
Access logs regularly reviewed, with no unauthorised access incidents.
Mappings
Closest match in ISO/IEC 27001: A.5.10, Acceptable use policies for information and assets, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.10.
ISM-1599 requires IT equipment to be handled in a manner suitable for its sensitivity or classification. ISO/IEC 27001:2022 Annex A 5.10 mandates documented rules for acceptable use and handling of information and associated assets, including IT equipment. Annex A 5.10 covers a broader range since it applies to various asset types, not just IT equipment.
This control partially overlaps A.7.8.
ISM-1599 requires IT equipment to be handled based on its sensitivity or classification. ISO/IEC 27001:2022 Annex A 7.8 requires secure siting and protection of equipment, aiding sensitivity-appropriate handling by mitigating risks of theft or unauthorised access to classified equipment. Annex A 7.8 is focused on physical security rather than classification-based handling processes.
This control partially overlaps A.7.14.
ISM-1599 requires IT equipment handling according to sensitivity or classification. ISO/IEC 27001:2022 Annex A 7.14 addresses secure disposal or re-use of storage media-containing equipment, ensuring sensitive data removal-a component of sensitivity-appropriate handling. Annex A 7.14 is narrower, focused on disposal/re-use, while ISM-1599 covers broader handling scenarios.
This control depends on A.5.12.
ISM-1599 mandates handling IT equipment based on sensitivity or classification. ISO/IEC 27001:2022 Annex A 5.12 outlines the organisation's information classification practices, essential for determining sensitivity/classification for equipment handling. Without classification (Annex A 5.12), consistent sensitivity-based handling per ISM-1599 is challenging.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.