ASD ISM 1789Maintain Reserve Spares of Critical IT and OT Equipment
Official control statement
Sufficient spares of critical IT equipment and OT equipment are sourced and kept in reserve.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Source and keep sufficient spares of critical IT and OT equipment in reserve so failed items can be quickly replaced.
What this means in practice
This control ensures your organisation keeps a stock of spare units and components for the IT and OT equipment your operations depend on. When a critical device fails, having spares already on hand means you can swap it out quickly instead of waiting for a supplier to deliver a replacement. This reduces downtime and keeps essential systems running while a permanent fix is arranged.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Proactive
Classifications
NC, OS, P, S, TS
ISM last updated
June 2024
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Topic
Sourcing operating systems, applications, IT equipment, OT equipment and services
Why it matters
Without a reserve of spares, a failure of critical IT or OT equipment could cause prolonged outages while replacements are sourced, disrupting essential operations.
Operational notes
Review spare holdings periodically as the equipment estate, failure history and supplier lead times change, and replenish reserves whenever spares are consumed.
Implementation tips
- Have asset owners identify which IT and OT equipment is critical to operations, then record the specific models and components that would need replacing if they fail.
- Task procurement with sourcing spare units and components for each critical item and storing them in a secure, environmentally suitable location ready for use.
- Set the quantity of spares to hold for each item based on its failure history, supplier lead times and the number of units in service, holding more where replacements are hard to obtain.
- Track every spare in the asset register, recording its location, quantity, firmware or configuration state and warranty status so it can be found and deployed quickly.
- Establish a replenishment process so that whenever a spare is used, a replacement is ordered promptly to restore the reserve to its target level.
Audit / evidence tips
- AskAsk which IT and OT equipment the organisation classifies as critical and how that list was determined.Look atThe criticality assessment and asset register identifying critical IT and OT items.GoodA current, documented list of critical equipment derived from a defined criticality methodology and reviewed regularly.
- AskAsk what spares are held for each critical item and where they are kept.Look atThe spares inventory or asset register entries and the physical or contracted storage location.GoodA maintained inventory listing spare units and components for each critical item, with recorded quantities and storage locations.
- AskAsk how the required quantity of spares for each item was decided.Look atThe analysis of failure rates, supplier lead times and installed unit counts used to set spare levels.GoodSpare levels justified by documented analysis of demand, lead time and criticality rather than arbitrary figures.
- AskAsk how spares are replenished once they have been used.Look atThe replenishment procedure and records of recent spare usage and reorders.GoodEvidence that consumed spares trigger timely reorders, keeping reserves at their intended levels.
- AskAsk how stored spares are kept fit for immediate use.Look atStorage conditions and records of firmware, patch or configuration maintenance for stored spares.GoodSpares held in suitable conditions and periodically checked so they are ready and current when deployed.
Cross-framework mappings
How ISM-1789 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(3)expand_less | ||
| Annex A 5.19 | ISM-1789 necessitates verifying the authenticity of software, hardware, and services prior to their supply chain acceptance | |
| Annex A 5.21 | ISM-1789 requires organisations to verify the authenticity of software, hardware, and services before their acceptance | |
| Annex A 8.14 | Annex A 8.14 requires information processing facilities to be implemented with redundancy sufficient to meet availability requirements | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Procurement and outsourcing
See all Guidelines for procurement and outsourcing controls, or browse the full ASD ISM library.