ISM control lookup / Topic

Guidelines for information technology equipment

35 controls · September 2026 edition

• ISM-0293 · Classifying IT equipment

  IT equipment is classified based on the highest sensitivity or classification of data that it is approved for processing, storing or communicating.

• ISM-0294 · Labelling IT equipment

  IT equipment, except for high assurance IT equipment, is labelled with protective markings reflecting its sensitivity or classification.

• ISM-0296 · Labelling high assurance IT equipment

  ASD’s approval is sought before applying labels to external surfaces of high assurance IT equipment.

• ISM-0305 · On-site maintenance or repairs

  Maintenance or repairs of IT equipment are carried out on site by an appropriately cleared technician.

• ISM-0306 · On-site maintenance or repairs

  If an appropriately cleared technician is not used to undertake maintenance or repairs to IT equipment, the technician is escorted by someone who:

• ISM-0307 · On-site maintenance or repairs

  If an appropriately cleared technician is not used to undertake maintenance or repairs to IT equipment, the IT equipment and associated media are sanitised before maintenance or repairs.

• ISM-0310 · Off-site maintenance or repairs

  IT equipment maintained or repaired off site is handled at facilities approved for handling the sensitivity or classification of the IT equipment.

• ISM-0311 · Sanitising IT equipment

  IT equipment containing media is sanitised by removing the media from the IT equipment or by sanitising the media in situ.

• ISM-0312 · Sanitising highly sensitive IT equipment

  IT equipment, including associated media, that is located overseas and has processed, stored or communicated AUSTEO or AGAO data that cannot be sanitised in situ, is returned to Australia for destruction.

• ISM-0313 · IT equipment sanitisation processes and procedures

  IT equipment sanitisation processes, and supporting IT equipment sanitisation procedures, are developed, implemented and maintained.

• ISM-0315 · Destroying high assurance IT equipment

  High assurance IT equipment is destroyed prior to its disposal.

• ISM-0316 · Disposal of IT equipment

  Following sanitisation, destruction or declassification, a formal administrative decision is made to release IT equipment, or its waste, into the public domain.

• ISM-0317 · Sanitising printers and multifunction devices

  At least three pages of random text with no blank areas are printed on each colour printer cartridge or MFD print drum.

• ISM-0318 · Sanitising printers and multifunction devices

  When unable to sanitise printer cartridges or MFD print drums, they are destroyed as per electrostatic memory devices.

• ISM-0321 · Disposal of IT equipment

  When disposing of IT equipment that has been designed or modified to meet emanation security standards, ASD is contacted for requirements relating to its disposal.

• ISM-0336 · IT equipment registers

  A networked IT equipment register is developed, implemented, maintained and regularly verified.

• ISM-1076 · Sanitising televisions and computer monitors

  Televisions and computer monitors with minor burn-in or image persistence are sanitised by displaying a solid white image on the screen for an extended period.

• ISM-1079 · Maintenance or repairs of high assurance IT equipment

  ASD’s approval is sought before undertaking any maintenance or repairs to high assurance IT equipment.

• ISM-1217 · Disposal of IT equipment

  Labels and markings indicating the owner, sensitivity, classification or any other marking that can associate IT equipment with its prior use are removed prior to its disposal.

• ISM-1218 · Sanitising highly sensitive IT equipment

  IT equipment, including associated media, that is located overseas and has processed, stored or communicated AUSTEO or AGAO data, is sanitised in situ.

• ISM-1219 · Sanitising printers and multifunction devices

  MFD print drums and image transfer rollers are inspected and destroyed if there is remnant toner that cannot be removed or a print is visible on the image transfer roller.

• ISM-1220 · Sanitising printers and multifunction devices

  Printer and MFD platens are inspected and destroyed if any text or images are retained on the platen.

• ISM-1221 · Sanitising printers and multifunction devices

  Printers and MFDs are checked to ensure no pages are trapped in the paper path due to a paper jam.

• ISM-1222 · Sanitising televisions and computer monitors

  Televisions and computer monitors that cannot be sanitised are destroyed.

• ISM-1223 · Sanitising network devices

  Memory in network devices is sanitised using the following processes, in order of preference:

• ISM-1534 · Sanitising printers and multifunction devices

  Printer ribbons in printers and MFDs are removed and destroyed.

• ISM-1550 · IT equipment disposal processes and procedures

  IT equipment disposal processes, and supporting IT equipment disposal procedures, are developed, implemented and maintained.

• ISM-1551 · IT equipment management policy

  An IT equipment management policy is developed, implemented and maintained.

• ISM-1598 · Inspection of IT equipment following maintenance or repairs

  Following maintenance or repairs to IT equipment, it is inspected to confirm that it retains its approved configuration and that no unauthorised modifications have been made.

• ISM-1599 · Handling IT equipment

  IT equipment is handled in a manner suitable for its sensitivity or classification.

• ISM-1741 · IT equipment destruction processes and procedures

  IT equipment destruction processes, and supporting IT equipment destruction procedures, are developed, implemented and maintained.

• ISM-1742 · Sanitising IT equipment

  IT equipment that cannot be sanitised is destroyed.

• ISM-1858 · Hardening IT equipment configurations

  IT equipment is hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.

• ISM-1869 · IT equipment registers

  A non-networked IT equipment register is developed, implemented, maintained and regularly verified.

• ISM-1913 · Hardening IT equipment configurations

  Approved configurations for IT equipment are developed, implemented and maintained.