ASD ISM 0078 Australian supervision of AUSTEO/AGAO data systems
What it says
Systems processing, storing or communicating AUSTEO or AGAO data remain at all times under the control of an Australian national working for or on behalf of the Australian Government.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnly Australian nationals should control systems handling sensitive Australian data.
This control requires that any system handling sensitive Australian data, specifically AUSTEO (Australian Eyes Only) or AGAO (Australian Government Access Only), must always be managed by an Australian citizen. This matters because allowing foreign nationals to control these systems increases the risk of sensitive data being accessed by individuals or entities not authorised by the Australian Government.
Free. Save your status, tasks and notes.
Why it matters
Allowing non-Australian nationals to manage AUSTEO/AGAO systems risks data leaks to unauthorised foreign entities, compromising national security.
How to implement
The system manager should verify the nationality of all staff who can control or manage systems containing AUSTEO or AGAO data.
This can be done by checking passports or other government-issued identification to confirm Australian citizenship.
The HR department should ensure that job descriptions for roles involving access to AUSTEO/AGAO systems clearly list Australian citizenship as a requirement.
This ensures that only eligible candidates can apply for these sensitive positions.
IT managers should configure access controls on AUSTEO/AGAO systems to ensure that only approved accounts belonging to Australian citizens have administrative rights.
This can be set up through identity verification tools and tight account management processes.
The compliance officer should regularly audit staff lists and access logs to ensure only Australian nationals are controlling these systems.
They can use automated tools designed for monitoring access to maintain oversight efficiently.
Procurement teams should ensure any service contracts involving access to AUSTEO/AGAO systems specify that staff must be Australian citizens.
They should include specific clauses in contracts and verify the compliance of contractors at regular intervals.
Keep it running
Weekly confirm AUSTEO/AGAO admins are Australian nationals acting for the Australian Government, and review access lists/logs for any non-compliant accounts.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The personnel list of individuals with access to AUSTEO/AGAO systems: Verify that the list includes only Australian citizens.
Look at
Documentation proving citizenship, such as a copy of a passport.
Good evidence
Is that all listed individuals have citizenship proof on file.
- Check 2 of 5What an auditor asks for
Good evidence
Includes all job descriptions with this stipulation, demonstrating compliance with hiring policies.
- Check 3 of 5What an auditor asks for
Good evidence
Shows audit logs reflecting access attempts and confirms access was granted only to authorised accounts.
- Check 4 of 5What an auditor asks for
Ask for
How they verify citizenship when hiring for these roles and how they update access when employment status changes.
Good evidence
Involves checking citizenship upon hiring and maintaining a current list of authorised individuals.
- Check 5 of 5What an auditor asks for
Good evidence
Includes contract excerpts confirming these requirements and the practice of regular contractor compliance checks.
Mappings
Closest match in ISO/IEC 27001: A.8.2, Management of privileged access rights, which this control depends on.
ISO/IEC 27001: 1 mapping
This control depends on A.8.2.
ISM-0078 requires that systems handling AUSTEO/AGAO data remain under the control of an Australian national working for or on behalf of the Australian Government. Annex A 8.2 (Management of Privileged Access Rights) supports ISM-0078 by restricting and managing privileged access so that only appropriately authorised (and, for ISM-0078 purposes, Australian-national) administrators can exercise control over those systems. Annex A 8.2 does not address nationality or sovereign control requirements, but it provides the access-governance mechanism that helps enforce them.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.