ASD ISM 1789Maintain Reserve Spares of Critical IT and OT Equipment
Source and keep sufficient spares of critical IT and OT equipment in reserve so failed items can be quickly replaced.
Plain language
This control ensures your organisation keeps a stock of spare units and components for the IT and OT equipment your operations depend on. When a critical device fails, having spares already on hand means you can swap it out quickly instead of waiting for a supplier to deliver a replacement. This reduces downtime and keeps essential systems running while a permanent fix is arranged.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
June 2024
Control Stack last updated
10 Aug 2026
E8 maturity levels
N/A
Official control statement
Sufficient spares of critical IT equipment and OT equipment are sourced and kept in reserve.
Why it matters
Without a reserve of spares, a failure of critical IT or OT equipment could cause prolonged outages while replacements are sourced, disrupting essential operations.
Operational notes
Review spare holdings periodically as the equipment estate, failure history and supplier lead times change, and replenish reserves whenever spares are consumed.
Implementation tips
- Have asset owners identify which IT and OT equipment is critical to operations, then record the specific models and components that would need replacing if they fail.
- Task procurement with sourcing spare units and components for each critical item and storing them in a secure, environmentally suitable location ready for use.
- Set the quantity of spares to hold for each item based on its failure history, supplier lead times and the number of units in service, holding more where replacements are hard to obtain.
- Track every spare in the asset register, recording its location, quantity, firmware or configuration state and warranty status so it can be found and deployed quickly.
- Establish a replenishment process so that whenever a spare is used, a replacement is ordered promptly to restore the reserve to its target level.
Audit / evidence tips
- AskAsk which IT and OT equipment the organisation classifies as critical and how that list was determined.GoodA current, documented list of critical equipment derived from a defined criticality methodology and reviewed regularly.
- AskAsk what spares are held for each critical item and where they are kept.GoodA maintained inventory listing spare units and components for each critical item, with recorded quantities and storage locations.
- AskAsk how the required quantity of spares for each item was decided.GoodSpare levels justified by documented analysis of demand, lead time and criticality rather than arbitrary figures.
- AskAsk how spares are replenished once they have been used.GoodEvidence that consumed spares trigger timely reorders, keeping reserves at their intended levels.
- AskAsk how stored spares are kept fit for immediate use.GoodSpares held in suitable conditions and periodically checked so they are ready and current when deployed.
Cross-framework mappings
How ISM-1789 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
linkRelated(2)expand_less | ||
| Annex A 5.19 | ISM-1789 necessitates verifying the authenticity of software, hardware, and services prior to their supply chain acceptance | |
| Annex A 5.21 | ISM-1789 requires organisations to verify the authenticity of software, hardware, and services before their acceptance | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Procurement and outsourcing
See all Guidelines for procurement and outsourcing controls, or browse the full ASD ISM library.