Information technology equipment

search account_circle

policyASD ISM

Guidelines for information technology equipment

36 controls in this part of theASD ISM. Each control links to plain-English guidance, audit tips and cross-framework mappings.

IT equipment disposal

Formal Decision on IT Equipment Disposal

Before IT equipment is publicly released, it must be sanitised and authorised after a formal decisio

Contact ASD for Guidance on Secure IT Disposal

Ensure secure disposal of certain IT equipment by consulting the ASD for requirements.

Remove Identifying Labels from IT Equipment Before Disposal

Before throwing away IT equipment, remove any labels that show ownership or use.

Develop and Maintain IT Equipment Disposal Procedures

Ensure IT equipment is disposed of properly by following established procedures.

It Equipment Maintenance Or Repairs

On-Site IT Equipment Maintenance by Cleared Technicians

Ensure IT equipment maintenance is done onsite by technicians with proper clearance.

Escort Uncleared Technicians During IT Equipment Maintenance or Repairs

When a technician who lacks the required security clearance works on your IT equipment, a suitable c

Sanitise Equipment When Not Using Cleared Technician

Sanitise IT equipment if repairs are made by non-cleared technicians.

Off-Site IT Equipment Handling Approvals

Off-site IT repairs must be at approved facilities matching the equipment's classification level.

Inspect IT Equipment Post-Maintenance for Unauthorised Changes

After maintenance, check IT equipment to ensure no unapproved changes were made.

IT equipment maintenance or repairs

Seek Approval for High Assurance IT Repairs

Get ASD's approval before repairing sensitive IT systems.

It Equipment Sanitisation and Destruction

Sanitise Screen Burn-In With a Solid White Image

Televisions and computer monitors that show minor burn-in or image persistence must be sanitised by

Inspect and Destroy MFD Print Drums and Image Transfer Rollers

Inspect multifunction device print drums and image transfer rollers, and destroy any that still hold

IT equipment sanitisation and destruction

Ensuring Sanitisation of IT Equipment Media

Remove or clean media from IT equipment to ensure data is not left on the device.

Return Overseas Equipment for Destruction

Sensitive IT gear overseas must be sent back to Australia for destruction if it can't be cleaned the

Develop and Maintain IT Equipment Sanitisation Procedures

Organisations must create and uphold processes for properly cleaning and disposing of IT equipment.

Ensure Destruction of High Assurance IT Equipment

High assurance IT equipment must be destroyed before disposal to prevent data leaks.

Ensuring Data Erasure on Printer Cartridges and Drums

Print three full pages of random text to ensure no data remains on printer cartridges or drums.

Safely Disposing of Unsanitised Printer Components

Destroy printer cartridges or print drums if they can't be sanitised, like other memory devices.

Sanitise Overseas IT Equipment Handling Sensitive Data

Overseas IT equipment with sensitive data must be sanitised where it is located.

Inspect and Destroy Retained Images on Printer Platens

Check printer surfaces, and destroy them if they have any leftover text or images.

Processes for Sanitising Memory in Network Devices

Network devices should be cleared of data using specific steps to ensure memory is secure.

Destroy Unsanitised Televisions and Monitors

Televisions and monitors that can't be cleaned of data are to be physically destroyed.

Methods for Sanitising Network Device Memory

Network device memory is cleaned by following specific guidance or doing a reset and reinstalling fi

Prevent Inappropriate Export of Sensitive Data

Procedures are set to stop sensitive data from being sent to foreign systems that aren't suitable.

Implement IT Equipment Destruction Procedures

Create and maintain processes for safely destroying IT equipment.

Destroy Un-sanitizable IT Equipment Safely

If IT equipment can't be cleaned properly, it must be destroyed to ensure security.

It Equipment Usage

Label IT Equipment with Sensitivity Markings

Label IT equipment, except high assurance, with appropriate sensitivity or classification markings.

Develop and Maintain Networked IT Equipment Register

Keep a regularly checked list of IT equipment connected to the network.

Maintain Non-Networked IT Equipment Register

Ensure a non-networked IT equipment list is created and kept up-to-date.

IT equipment usage

Classify IT Equipment by Data Sensitivity

Label IT equipment based on the sensitivity of the data it handles.

Approval Required for High Assurance IT Equipment Labelling

Seek approval before labelling high assurance IT equipment to ensure security standards.

Develop and Maintain IT Equipment Management Policy

Organisations must create and sustain a policy for managing IT equipment.

Proper Handling of Sensitive IT Equipment

Ensure IT equipment is handled based on how sensitive or classified it is.

Implement Strict IT Equipment Hardening Guidelines

Use the most restrictive security guidelines to secure IT equipment from unauthorised access.

Develop and Maintain Approved IT Configurations

Ensure IT equipment is set up with approved configurations to enhance security.

Server Application Hardening

Ensure User Passwords Expire and Are Required

Ensure user accounts have passwords that expire and are always required.

Back to the full Australian Government Information Security Manual control list, or browse the complete control library.