Skip to content
Communications systems
ASD ISMISM-2075

ASD ISM 2075 Prohibit the use of fax machines for messages

What it says

Fax machines, and online fax services, are not used for sending or receiving fax messages.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Fax machines and online fax services should not be used to send or receive messages.

This control means you shouldn't use fax machines or online fax services to send or receive messages. This is important because faxes can be intercepted or received by the wrong person, risking the leakage of sensitive information or privacy breaches.

Why it matters

Allowing fax machines or online fax services can expose sensitive data via misdialled numbers, interception, or untrusted third-party handling.

How to implement

  1. Office managers should phase out existing fax machines by setting a clear deadline for discontinuation.

    Determine any ongoing dependencies on fax technology and coordinate with each department to transition to secure communication methods like email or secure messaging platforms.

  2. IT teams should disable fax capabilities on multifunctional devices.

    Check all devices for fax functionality and ensure that the option to send or receive faxes is deactivated or removed from settings to comply with this control.

  3. Procurement departments should update purchasing policies to exclude fax machines.

    Ensure all new office equipment acquisitions strictly follow updated policies by specifying that devices capable of faxing are not purchased or leased.

  4. HR should run an awareness campaign for staff about the risks of using fax.

    Create and send out a memo or conduct a short training session to explain why faxes are banned and which secure alternatives are now in place.

  5. The IT team should implement and promote secure digital alternatives.

    Set up secure file transfer protocols or encrypted email as alternatives, providing training and support to staff on how to use these new tools effectively.

Keep it running

Confirm no physical fax devices, fax-enabled printers or online fax services exist; periodically review vendor contracts, phone lines and user requests for reintroduction.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    An inventory report of office equipment: Verify that no devices include fax as an active feature.

    Look at

    Whether any multifunction devices still have fax capabilities enabled.

    Good evidence

    Is a current report showing all devices with fax functions removed or disabled.

  2. Check 2 of 5What an auditor asks for

    Good evidence

    Is a well-distributed policy document with clear directives on secure communication.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Staff training records: Check for evidence of training conducted about the new policy and secure communication tools.

    Look at

    Attendance records and training materials.

    Good evidence

    Includes dated records of training sessions with clear content related to the change.

  4. Check 4 of 5What an auditor asks for

    Good evidence

    Is active usage logs and positive adoption feedback from staff.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Procurement records: Verify that recent equipment purchases follow the updated policy.

    Look at

    Contract and purchase agreements that explicitly exclude fax capabilities.

    Good evidence

    Includes recent procurement documents with clear terms excluding faxes.

Mappings

Closest match in ISO/IEC 27001: A.5.10, Acceptable use policies for information and assets, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.5.10Acceptable use policies for information and assetsPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.