ASD ISM 0164 Prevent unauthorised viewing of system displays
What it says
Unauthorised people are prevented from observing systems, in particular workstation displays and keyboards, within facilities.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that unauthorised individuals can't see computer screens or keyboards in secure areas.
This control is about making sure that people who aren't supposed to see sensitive information can't sneak a peek at your computer screens or watch you type passwords and other confidential data. If this isn't done, someone could easily gather important information simply by glancing at your screen, potentially leading to data breaches or security incidents.
Free. Save your status, tasks and notes.
Why it matters
Shoulder-surfing of workstation screens or keyboards can expose sensitive information and credentials, leading to unauthorised disclosure and compromise.
How to implement
Managers should arrange office furniture so that screens aren't visible from public or unauthorised areas.
This might mean moving desks or adding partitions to block the view from windows or doorways where visitors pass by.
IT teams should install privacy screens on monitors in areas where the risk of viewing by unauthorised people is high.
These screens limit the viewing angle, making it harder to see the display from the side.
Facilities management should ensure blinds or curtains are available and used on any windows that could potentially expose screens to people outside the building.
During critical or confidential work, blinds should be closed to prevent viewing.
All staff should be trained to lock their computers when stepping away from their desk, even for a short time.
This can be done through regular reminders and enabling automatic lock settings after periods of inactivity.
Security personnel or admins should conduct regular walk-throughs in secure areas to spot risks like visible screens or unauthorised access, and ensure compliance with these practices.
Keep it running
Conduct routine walk-throughs to spot visible screens/keyboards; reposition monitors away from public sightlines and fit privacy filters in shared or high-traffic areas.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A floor plan showing desk arrangements.
Look at
How desks and screens are positioned in relation to public areas. Good layout minimises screen exposure to unauthorised individuals.
- Check 2 of 5What an auditor asks for
Look at
Records showing where privacy screens are installed.
Good evidence
Includes dates of installation and maintenance checks.
- Check 3 of 5What an auditor asks for
Ask for
Employees if they consistently lock their screens when away.
Good evidence
Is consistent staff awareness and practice of this security habit.
- Check 4 of 5What an auditor asks for
Good evidence
Observation shows quick adaptability to close or adjust as needed.
- Check 5 of 5What an auditor asks for
Look at
Documented training sessions that cover screen security. Good records show regular training intervals and a majority of staff completion.
Mappings
Closest match in ISO/IEC 27001: A.7.2, Physical access controls for secure areas, which this control covers in full and more.
ISO/IEC 27001: 5 mappings
This control is broader than A.7.2.
ISM-0164 requires preventing unauthorised viewing of workstation displays and keyboards inside facilities. ISO/IEC 27001:2022 Annex A 7.2 requires appropriate physical entry controls for secure areas, which reduces the likelihood that unauthorised people can get close enough to observe screens. A 7.2 is broader (who can enter), while ISM-0164 is about what can be observed even within or near those areas.
This control partially meets A.7.3.
ISM-0164 requires that unauthorised individuals cannot observe system displays and keyboards within facilities. ISO/IEC 27001:2022 Annex A 7.3 requires physical security for offices, rooms and facilities to be designed and implemented, which can include workstation placement, visitor management, and sightline controls that directly help meet ISM-0164. Annex A 7.3 is broader across facility physical security, while ISM-0164 is a specific protection objective focused on visual observation.
This control partially meets A.7.6.
Annex A 7.6 requires security measures to control and protect activities in secure areas, including preventing information exposure during routine work. ISM-0164 directly relates by requiring prevention of unauthorised observation of systems (e.g. workstation displays and keyboards) within facilities, which is a common secure-area working protection against shoulder-surfing and incidental disclosure. ISM-0164 is a specific visual-security requirement, while Annex A 7.6 is broader and includes additional secure-area measures beyond display protection.
This control partially overlaps A.7.7.
ISM-0164 requires preventing unauthorised people from observing system displays and keyboards within facilities. ISO/IEC 27001:2022 Annex A 7.7 mandates clear screen rules (and clear desk) to reduce exposure of information on displays when unattended, which addresses a key scenario of unauthorised viewing. ISM-0164 additionally covers physical observation risks even while a user is present (e.g. shoulder surfing and keyboard observation), whereas A 7.7 focuses on procedural display/desk hygiene.
This control partially overlaps A.7.8.
ISM-0164 requires preventing unauthorised people from observing workstation displays and keyboards within facilities. ISO/IEC 27001:2022 Annex A 7.8 requires equipment to be sited securely and protected, which can include positioning screens away from public sightlines and using physical protections that reduce observation. Annex A 7.8 also covers broader equipment protection (e.g. damage, theft) beyond visual privacy, while ISM-0164 specifically targets unauthorised viewing and keyboard observation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.