ASD ISM 0409 Restricting foreign national access to AUSTEO and REL systems
What it says
Foreign nationals, including seconded foreign nationals, do not have access to systems that process, store or communicate AUSTEO or REL data unless effective security controls are in place to ensure such data is not accessible to them.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeep foreign nationals, including secondees, off systems holding AUSTEO or REL data unless proven controls stop them from reaching that data.
Some Australian Government information carries a caveat that limits who may see it by nationality. AUSTEO data is for Australian eyes only, and REL data may only be released to the specific foreign partners named in the caveat. This control says that foreign nationals, including foreign nationals seconded into your organisation, must not have access to any system that processes, stores or communicates that data. The only exception is where effective security controls are in place that genuinely ensure the caveated data cannot be reached by them. This control deals with unprivileged access (ordinary user access); privileged access by foreign nationals to these systems is addressed by a separate ISM control and is not covered by the exception described here. The point is that caveats are enforced by systems as well as by people. A foreign national who holds a legitimate role and a valid clearance may still be someone the caveat excludes. If they can log on to or read traffic from a system that carries AUSTEO or REL data, the caveat has been broken even if nobody intended it. The risk covers the whole system, not just the files: processing, storage and the network paths the data travels over. Secondees are called out specifically because they are often treated as internal staff and slip past nationality checks that would catch an external partner.
Free. Save your status, tasks and notes.
Why it matters
If foreign nationals can reach a system holding AUSTEO or REL data without effective controls separating them from it, caveated information can be disclosed to a person or nation it was never released to. That is a breach of the caveat regardless of intent, can damage Australia's interests and its relationships with partners who shared the data, and may lead to loss of the system's authorisation to operate and loss of the partner's willingness to share further information.
How to implement
The information security team identifies and records every system that processes, stores or communicates AUSTEO or REL data, including any network links that carry it, so the systems in scope for this control are known and can be checked against access lists.
Human resources and security staff record nationality for all personnel, capturing seconded foreign nationals as well as contractors and visitors, and make that information available to whoever approves system access.
System owners configure access provisioning for in-scope systems so that a request from a foreign national is blocked by default and can only proceed through a documented exception decision confirming that effective security controls are in place to keep the caveated data out of reach.
Where a system must be shared, the system owner and security architect implement and document security controls that ensure the caveated data cannot be reached by the foreign national, then test those controls before access is granted.
Security staff run a periodic reconciliation of unprivileged user accounts on each AUSTEO or REL system against nationality records, removing any foreign national access that lacks an approved and still-effective exception, and treat any foreign national holding a privileged account as a separate matter under the ISM control on privileged access.
Keep it running
Day to day, this control lives in three places: knowing which systems process, store or communicate AUSTEO or REL data; knowing which personnel, including secondees, are foreign nationals; and making sure the two never overlap unless an approved, effective control keeps the data out of reach.
Keep the register of AUSTEO and REL systems current, because data moves and new systems are connected. Feed nationality information from onboarding and secondment paperwork into the access provisioning process so that a request from a foreign national for an in-scope system is stopped or routed to a decision about compensating controls. Where an exception relies on security controls (for example, separation that prevents the foreign national from reaching the caveated data on a shared system), those controls need to be documented, tested and reviewed, since the control only permits access when they are effective. Revisit exceptions whenever the system, the data it carries or the person's role changes, and remove access promptly when secondments end.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the register of systems that process, store or communicate AUSTEO or REL data.
Look at
Check that it covers storage, processing and the communication paths, and that it has been updated as systems and data flows changed.
Good evidence
A current list, owned by a named person, that matches what the organisation actually runs, with no in-scope system missing.
- Check 2 of 5What an auditor asks for
Ask for
Ask how the organisation knows which personnel are foreign nationals, including secondees.
Look at
Look at onboarding and secondment records and whether nationality is captured and passed to those who approve access.
Good evidence
Nationality is recorded for everyone with system access, secondees are clearly flagged, and the access approver can see it before a decision.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the current unprivileged user account lists for a sample of AUSTEO or REL systems.
Look at
Compare the accounts against nationality records to see whether any foreign national holds unprivileged access. Note that privileged accounts held by foreign nationals fall under the separate ISM control on privileged access and are not covered by this control's exception.
Good evidence
No foreign national has unprivileged access, or every instance is tied to a documented exception with effective controls in place.
- Check 4 of 5What an auditor asks for
Ask for
Ask for documentation of any exception where a foreign national has access to an in-scope system.
Look at
Check what security controls are claimed to keep the caveated data out of reach, who approved them, and whether they have been tested.
Good evidence
Each exception names the controls, shows evidence they were tested and found effective, and is reviewed on a set cycle.
- Check 5 of 5What an auditor asks for
Ask for
Ask what happens when a secondment ends or a person's role or nationality status changes.
Look at
Look at offboarding and access review records for evidence that access to in-scope systems was removed or re-assessed.
Good evidence
Access is removed promptly when secondments end and exceptions are re-assessed whenever the person, system or data changes.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control depends on.
ISO/IEC 27001: 3 mappings
This control depends on A.5.15.
ISM-0409 requires that foreign nationals do not have access to systems processing AUSTEO or REL data unless controls ensure the data is not accessible to them. ISO/IEC 27001:2022 Annex A 5.15 establishes the organisation's access control rules and policies necessary to encode nationality-based restrictions and the requirement for data to be inaccessible.
This control depends on A.5.18.
ISM-0409 requires that foreign nationals cannot access AUSTEO or REL data unless protected by strict controls. ISO/IEC 27001:2022 Annex A 5.18 supports this by overseeing the management of access rights, essential for applying and maintaining the restrictions necessary to comply with ISM-0409.
This control depends on A.8.3.
ISM-0409 mandates preventing foreign nationals from accessing AUSTEO/REL data unless controls ensure data is inaccessible. ISO/IEC 27001:2022 Annex A 8.3 focuses on restricting access to information in line with access control policies, used to implement nationality-based restrictions.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.