ASD ISM 1869 Maintain non-networked IT equipment register
What it says
A non-networked IT equipment register is developed, implemented, maintained and regularly verified.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure a non-networked IT equipment list is created and kept up-to-date.
Creating and maintaining a list of IT equipment that isn't connected to the network helps you track what devices you have and ensures they're managed securely. If you don't have this list, you might miss a device that becomes a security risk or gets lost or stolen.
Free. Save your status, tasks and notes.
Why it matters
Without a maintained registry of non-networked devices, organisations risk unmanaged equipment causing data loss or security breaches.
How to implement
A designated IT manager should create an initial list of all non-networked IT equipment by conducting a physical audit of the organisation's premises.
This involves walking through all office areas and identifying devices such as standalone printers or backup hard drives.
An inventory manager should input all collected details like serial numbers and location into a central register.
This could be a spreadsheet or a simple database maintained on a secure drive.
The office manager should establish a process for updating the register whenever new equipment is purchased or existing equipment is decommissioned.
Regular updates can be scheduled alongside monthly budget reviews.
The HR team should include a step in the employee onboarding checklist to check and update the register if relevant, such as when a new device is allocated to an employee.
The IT manager should conduct a quarterly review to verify the register's accuracy by cross-referencing it with purchase records and conducting a spot-check of equipment locations.
Keep it running
Regularly review and update the non-networked IT equipment register to quickly identify any missing or unauthorised devices.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the non-networked IT equipment register.
Look at
it to ensure it lists all stand-alone devices and includes details like serial numbers and location.
Good evidence
is a comprehensive, neatly organised list covering all equipment.
- Check 2 of 5What an auditor asks for
Ask for
recent updates or changes to the register.
Look at
timestamps or change logs that show the register is updated regularly.
Good evidence
is evidence of recent entries or modifications.
- Check 3 of 5What an auditor asks for
Look at
clearly defined steps and responsible parties.
Good evidence
includes a document that outlines procedures and designated roles.
- Check 4 of 5What an auditor asks for
Look at
checklists or documentation indicating recent completion.
Good evidence
includes evidence of a recent physical equipment audit.
- Check 5 of 5What an auditor asks for
Ask for
to see training or briefing material used for employees involved in maintaining the register.
Look at
content relevance and delivery records.
Good evidence
is up-to-date training documents with attendance logs.
Mappings
Closest match in ISO/IEC 27001: A.5.9, Inventory management of information and associated assets, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.9.
ISM-1869 requires an organisation to develop, implement, maintain and regularly verify a register of non-networked IT equipment. ISO/IEC 27001:2022 Annex A 5.9 requires an inventory of information and associated assets (including owners) to be developed and maintained, which can and should include non-networked equipment. ISM-1869 is more specific in scope (non-networked equipment) and adds an explicit verification expectation, while Annex A 5.9 is broader across all information assets.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.