ASD ISM 0430 Same-day removal or suspension of access no longer required
What it says
Access to systems and their resources are removed or suspended the same day users no longer have a legitimate requirement for access.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWhen a user's need for access ends, their access to systems and resources is cut off (removed or suspended) that same day, not days or weeks later.
People's access needs change all the time. Someone leaves the organisation, a contractor's engagement finishes, a staff member moves to a different team, or a project wraps up. Whenever any of these happen, the person no longer has a legitimate reason to reach the systems and resources they were using, and this control requires that their access is removed or suspended on the same day. The "or suspended" part matters. You do not have to fully delete an account on day one if there is a business reason to keep it around (for example, handing over files or an audit trail). Disabling it so it cannot be used is enough, as long as that happens the same day. Why it matters: access that lingers after the need has gone is one of the easiest ways for something to go wrong. A departing employee might still be able to log in from home, a former contractor's credentials could be phished or reused, or a person who moved teams keeps quietly accumulating rights they should not have. Every day the access stays open is a day it can be misused, whether deliberately or through a compromised credential. Closing it the same day shrinks that window to almost nothing.
Free. Save your status, tasks and notes.
Why it matters
If access is not removed or suspended the same day, former staff, finished contractors and people who have changed roles keep working credentials they have no legitimate need for. Those credentials can be used to read, copy or alter information, and if they are compromised by an attacker they provide a ready-made foothold that nobody is watching. Lingering access also undermines the accuracy of your access records, making it harder to prove who could reach what and weakening any assurance you give to auditors or partners.
How to implement
HR and people managers: notify the IT service desk or identity team on the day a person leaves, finishes a contract, changes role or completes a project, using a standard leaver or change-of-role form that records the date the access requirement ends.
Identity and access administrators: on receipt of that notification, disable or remove the person's accounts in the directory and identity provider that same day, then work through every connected system and resource (email, shared drives, applications, SaaS tenants, databases, remote access) using an access inventory for that person.
System owners: link account status to the HR or contractor record so that a leaver or role-change event automatically suspends the associated accounts on the effective date, with manual removal following for anything not covered by automation.
Managers granting temporary or project access: set an expiry date on the access at the time it is granted so it is suspended automatically when the project or engagement ends, rather than relying on someone remembering.
Identity team: for role changes, remove the access tied to the old role on the day of the move (not just add the new access), and reconcile the person's remaining entitlements against their new role so nothing legitimate is lost and nothing surplus stays.
Keep it running
Day to day, this control lives or dies on how quickly the people who know a requirement has ended tell the people who can act on it. Managers, HR, procurement and project leads are usually the first to know that someone is leaving, finishing or moving; IT and system owners are the ones who disable or remove the access.
Keep the trigger list broad. It is not only terminations: role changes, end of contract, end of a project or secondment, and a temporary access grant reaching its end date all mean the legitimate requirement has gone. Treat "systems and their resources" broadly too, covering not just the network or directory account but shared drives, applications, SaaS tenants, databases, remote access, physical tokens and any service accounts or API keys the person controlled.
Where full removal takes time (data handover, mailbox retention, licence reassignment), suspend first the same day and complete the removal afterwards. Record the date the requirement ended and the date the access was suspended or removed, so you can show they match.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the documented procedure for removing or suspending access when a user no longer needs it, including who triggers it and who actions it.
Look at
Check that the procedure sets a same-day timeframe, covers leavers, contractors, role changes and end of project or temporary access, and includes systems and their resources rather than just the main login.
Good evidence
A clear procedure that requires removal or suspension on the same day the requirement ends, names the roles responsible for notifying and actioning, and lists the resources to be covered.
- Check 2 of 5What an auditor asks for
Ask for
Request a list of people who left, finished contracts or changed roles in a recent period, together with the dates their access requirement ended.
Look at
Compare those dates with the dates their accounts were disabled or removed in the directory, identity provider and key applications.
Good evidence
For every person sampled, the suspension or removal date is the same as the date the requirement ended, with any exceptions explained and documented.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the leaver, contractor-completion and role-change notifications sent to IT for the sampled people.
Look at
Check that a notification exists for each person and that it was sent on or before the day the requirement ended, not days later.
Good evidence
Timely notifications exist for all sampled cases, showing the trigger reached the people who action access on the same day.
- Check 4 of 5What an auditor asks for
Ask for
Request a current list of enabled accounts and compare it against the current staff and contractor register.
Look at
Look for enabled accounts belonging to people who are no longer employed or engaged, or whose recorded role no longer justifies the access.
Good evidence
No enabled accounts belong to people without a current legitimate requirement, or any found are recent and already in the process of being suspended the same day.
- Check 5 of 5What an auditor asks for
Ask for
Ask for evidence of how access to the wider resources (shared drives, applications, SaaS tenants, remote access, tokens) was handled for the sampled people.
Look at
Check the access inventory or removal checklist for each person to see that each resource was suspended or removed and when.
Good evidence
Each sampled person has a completed checklist or system record showing all their systems and resources were suspended or removed on the same day, with any staged full removal completed afterwards.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 5 mappings
This control partially meets A.5.15.
ISM-0430 requires rapid deprovisioning by removing or suspending access the same day it is no longer legitimately required. Annex A 5.15 establishes the rules, policies, and procedures for controlling logical (and physical) access, which is the governance mechanism that typically defines when access should be removed and who authorises it. Annex A 5.15 does not itself mandate same-day revocation, but it supports implementing ISM-0430 by providing the policy basis and process triggers for timely access removal.
This control partially meets A.5.16.
ISM-0430 requires that access to systems and resources is removed or suspended the same day a user no longer has a legitimate need. Annex A 5.16 (Identity life cycle management) requires the organisation to manage identities across their full lifecycle, including joiner/mover/leaver processes and deprovisioning. ISM-0430 is a specific timeliness requirement within that broader lifecycle control and is more prescriptive about the speed of removal/suspension.
This control partially meets A.5.18.
ISM-0430 requires same-day removal or suspension of access when it is no longer required. Annex A 5.18 requires access rights to be provisioned, reviewed, modified, and removed in accordance with the organisation's access control policy and rules. ISM-0430 is a specific, measurable implementation expectation (same-day deprovisioning) within the broader access-rights management process described by Annex A 5.18.
This control partially overlaps A.5.11.
Annex A 5.11 requires that, when personnel or other interested parties leave or change roles, they return all organisational assets in their possession. ISM-0430 relates by requiring same-day removal or suspension of system access when personnel no longer have a legitimate need, which is a key part of effective offboarding alongside asset return. ISM-0430 is focused on logical access revocation, while Annex A 5.11 is focused on the return of physical and information assets (e.g. devices, tokens, documents) rather than access rights.
This control partially overlaps A.6.5.
Annex A 6.5 requires information security responsibilities and duties that continue after termination or a role change to be defined, enforced and communicated. ISM-0430 relates by mandating same-day removal or suspension of system access when personnel no longer have a legitimate requirement, which is a key offboarding/mover enforcement activity aligned to post-change security obligations. However, Annex A 6.5 is broader in covering ongoing obligations (e.g. confidentiality, return of assets, continued handling requirements) and communication to interested parties, not just access removal timing.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.