ASD ISM 0411 Restricting foreign national access to systems handling AGAO data
What it says
Foreign nationals, excluding seconded foreign nationals, do not have access to systems that process, store or communicate AGAO data unless effective security controls are in place to ensure such data is not accessible to them.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeeps AGAO data away from foreign nationals (other than seconded ones) by denying them system access, or by proving controls stop them reaching that data.
Some Australian Government information carries the AGAO (Australian Government Access Only) caveat, which means it is intended for Australian Government personnel only and is not to be released to foreign nationals. This control extends that rule from the document to the system. If a system processes, stores or communicates AGAO data, foreign nationals should not have access to that system at all, unless the organisation has put effective security controls in place that genuinely stop them reaching the AGAO data. There is one carve-out: seconded foreign nationals. These are foreign nationals formally seconded into an Australian Government organisation, and the statement excludes them from the restriction. Everyone else who is a foreign national, whether a contractor, a vendor engineer, a partner-agency officer or a service desk operator, falls within scope. Why it matters: the AGAO caveat exists because the information was assessed as unsuitable for foreign release. Giving a foreign national an account on a shared file server, a mailbox on the same mail platform, or administrative rights over the storage that holds the data can undermine that assessment even when nobody intends to hand the data over. Administrators in particular often see everything a system holds. The control forces the organisation to either keep foreign nationals off such systems or to demonstrate, with real technical and procedural controls, that the AGAO data is not accessible to them.
Free. Save your status, tasks and notes.
Why it matters
If foreign nationals hold access to a system that handles AGAO data without effective controls separating them from it, information that was caveated as not for foreign release may be viewed, copied or forwarded outside the Australian Government. The control is breached as soon as that access exists without effective controls, even where the person never looked at the data, because the statement requires the controls to be in place, not merely that no disclosure has occurred. Consequences include a reportable security incident, loss of trust from the originating agency, withdrawal of the organisation's access to caveated material, and possible contractual or clearance consequences for the individuals and sponsors involved.
How to implement
The system owner, with the security team, tags every system that processes, stores or communicates AGAO data in the system register, so access approvers can see at a glance which systems are in scope for this control.
The personnel security or HR team records nationality and, where applicable, seconded foreign national status for every user and contractor in the identity source of truth, and keeps it current when secondments start or end.
The access management team adds a mandatory nationality and secondment check to the access request workflow for in-scope systems, so a request from a foreign national who is not a seconded foreign national is automatically routed for refusal or to the formal exception process.
Where the organisation chooses to allow a foreign national onto an in-scope system, the security team designs, documents and tests the controls that keep AGAO data unreachable (for example segregated enclaves, labelling with enforced access rules, or restricted repositories), and obtains sign-off before access is granted.
The system owner runs a periodic access review of all user accounts on in-scope systems, cross-checking each account holder against nationality and secondment records and removing or re-approving any foreign national access found.
Keep it running
Day to day, this control lives at the intersection of personnel security and access management.
- **Know where AGAO data lives.** The restriction only bites on systems that process, store or communicate AGAO data, so the system register or data inventory needs to flag which systems those are. If nobody knows, the default is to treat any system that receives caveated material as in scope.
- **Know who is a foreign national.** Nationality and secondment status should be captured during onboarding and clearance sponsorship and kept current in the identity source of truth. Dual nationals and contractors are the common blind spots.
- **Gate access requests.** Access approvals for in-scope systems should check the requester's nationality and secondment status before an account is created. A foreign national who is not a seconded foreign national is refused unless the compensating controls route is formally used.
- **Treat the controls route as the exception, not the norm.** Where the organisation decides to let a foreign national onto an in-scope system, the security controls (for example separate enclaves, mandatory labelling with access enforcement, or restricted shares) need to be documented, approved and tested to show that AGAO data is genuinely not reachable.
- **Watch for drift.** Systems change purpose, foreign nationals change roles, secondments end. Periodic access reviews for in-scope systems should specifically re-check nationality and secondment status, not just whether the account is still used.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the list of systems that process, store or communicate AGAO data.
Look at
Check whether the system register or data inventory actually identifies these systems, and how the organisation decided which ones qualify.
Good evidence
A maintained register clearly flags in-scope systems, with a documented basis for the classification, so access approvers know where the restriction applies.
- Check 2 of 5What an auditor asks for
Ask for
Ask how nationality and seconded foreign national status are captured and kept current for users and contractors.
Look at
Look at onboarding records, clearance sponsorship files and the identity directory to see whether this information exists and is reliable.
Good evidence
Nationality and secondment status are recorded at onboarding, held in the identity source of truth, and updated when secondments begin or end.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the access request and approval procedure for in-scope systems.
Look at
Trace a sample of recent approvals to see whether nationality and secondment status were checked before access was granted.
Good evidence
Every sampled approval shows the check was performed, and any foreign national who is not a seconded foreign national was either refused or handled through a documented exception.
- Check 4 of 5What an auditor asks for
Ask for
Ask for any cases where a foreign national has been granted access to an in-scope system under the security controls exception.
Look at
Review the documented controls, the risk acceptance, and any testing that shows AGAO data is not accessible to that person.
Good evidence
Each exception has approved, documented controls that were tested to confirm AGAO data is unreachable, and the approval is current.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the most recent access review of an in-scope system.
Look at
Compare the account list against nationality and secondment records to see whether any foreign national access exists without an approved exception.
Good evidence
The review explicitly rechecked nationality and secondment status for every account, and any unapproved foreign national access was removed and recorded.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.15.
ISM-0411 requires foreign nationals (excluding seconded foreign nationals) to be prevented from accessing AGAO data on systems unless effective controls ensure the data is not accessible to them. Annex A 5.15 demands an organisation to establish and implement access control policies and procedures based on security requirements. ISM-0411 is a specific nationality-based access restriction use case typically encompassed within the broader access control policy framework described in Annex A 5.15.
This control partially meets A.5.18.
ISM-0411 requires blocking foreign nationals from accessing AGAO data on relevant systems unless controls ensure the data is not accessible to them. Annex A 5.18 demands that access rights be provisioned, reviewed, modified and removed according to access control rules, covering the access lifecycle for all users and assets. ISM-0411 is a specific rule for a defined user cohort that aligns with the broader lifecycle processes in Annex A 5.18.
This control partially meets A.8.3.
ISM-0411 requires denying foreign nationals access to systems handling AGAO data unless controls prevent them from reaching the data. ISO/IEC 27001:2022 Annex A 8.3 requires restricting access to information and associated assets in accordance with an access control policy, which is the direct technical/operational control family used to implement the ISM-0411 restriction. ISM-0411 is a specific rule about who may access AGAO data (and under what exception), while Annex A 8.3 is broader and applies to all access restrictions regardless of user nationality or data type.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.