ASD ISM 0420 Identify nationality of foreign personnel in system
What it says
Where systems process, store or communicate AUSTEO, AGAO or REL data, personnel who are foreign nationals are identified as such, including by their specific nationality.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure foreign nationals using the system are identified by their nationality for sensitive data security.
This control is about making sure you know which foreign nationals, with their specific nationalities, are using your system when dealing with certain types of sensitive data. It's crucial because if you don't know who is accessing your sensitive information, you could unknowingly expose it to foreign interests, which could lead to data breaches or misuse.
Free. Save your status, tasks and notes.
Why it matters
Failure to identify foreign nationals accessing sensitive AUSTEO/AGAO/REL data can increase the risk of unauthorised foreign exposure and reportable data breaches.
How to implement
HR should work with the IT team to keep a record of personnel's nationality: When a new staff member, especially from overseas, joins the company, HR should verify and document their nationality and share this information with IT for system access records.
The IT team should set up a system account flagging process: Implement functionality in your system to flag accounts of foreign nationals with their nationality details.
This helps system administrators keep track of who is accessing sensitive data.
Managers should ensure regular audits of user access data: Schedule monthly checks to review lists of users with access to sensitive systems, ensuring all foreign nationals are correctly flagged by nationality.
System owners need to update system access policies: Collaborate with legal and compliance teams to define roles and access levels appropriate for foreign nationals, aligning with your organisation's policy and any legal obligations.
Procurement should engage with verified identity management solutions: Invest in solutions that offer strong identity verification processes to efficiently gather and track user nationality information during the onboarding process.
Keep it running
Maintain HR/identity records to flag foreign nationals and record their exact nationality in access systems; review regularly when roles or clearances change.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The personnel nationality register: Request the document or system feature where personnel nationality is recorded.
Look at
Accurate entries of all foreign nationals linked to system access.
Good evidence
Is a detailed and up-to-date register accessible by HR and IT.
- Check 2 of 5What an auditor asks for
Ask for
The IT team to show how foreign nationals are flagged in the system.
Look at
How these flags appear and whether they include specific nationality details.
Good evidence
Demonstration reveals precise and consistently applied flags.
- Check 3 of 5What an auditor asks for
Ask for
Them how they verify and document the nationality of new hires.
Good evidence
Explains the verification process, where records are kept, and how this data is transferred to IT.
- Check 4 of 5What an auditor asks for
Look at
A detailed discussion and logical actions arising from foreign national flag reviews.
Good evidence
Meeting shows thorough review and understanding.
- Check 5 of 5What an auditor asks for
Ask for
To see policies regarding how foreign nationals can access sensitive data.
Look at
Clear guidelines differentiating access based on nationality.
Good evidence
Policy contains explicit procedures and compliance with legal requirements.
Mappings
Closest match in ISO/IEC 27001: A.5.16, Identity life cycle management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.16.
ISM-0420 requires that where systems process, store or communicate AUSTEO, AGAO or REL data, personnel who are foreign nationals are explicitly identified, including their specific nationality. Annex A 5.16 (Identity life cycle management) relates because capturing and maintaining authoritative identity attributes (including user characteristics needed for access decisions) is part of managing identities across joiner/mover/leaver processes. ISM-0420 is a specific identity-attribute requirement focused on foreign nationality in sensitive contexts, whereas Annex A 5.16 is broader and covers the whole identity lifecycle beyond nationality attributes.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.