ASD ISM 0430Same-Day Removal or Suspension of Access No Longer Required
Official control statement
Access to systems and their resources are removed or suspended the same day users no longer have a legitimate requirement for access.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
When a user's need for access ends, their access to systems and resources is cut off (removed or suspended) that same day, not days or weeks later.
What this means in practice
People's access needs change all the time. Someone leaves the organisation, a contractor's engagement finishes, a staff member moves to a different team, or a project wraps up. Whenever any of these happen, the person no longer has a legitimate reason to reach the systems and resources they were using, and this control requires that their access is removed or suspended on the same day. The "or suspended" part matters. You do not have to fully delete an account on day one if there is a business reason to keep it around (for example, handing over files or an audit trail). Disabling it so it cannot be used is enough, as long as that happens the same day. Why it matters: access that lingers after the need has gone is one of the easiest ways for something to go wrong. A departing employee might still be able to log in from home, a former contractor's credentials could be phished or reused, or a person who moved teams keeps quietly accumulating rights they should not have. Every day the access stays open is a day it can be misused, whether deliberately or through a compromised credential. Closing it the same day shrinks that window to almost nothing.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Sept 2026
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for system accessTopic
Suspension of access to systems
Why it matters
If access is not removed or suspended the same day, former staff, finished contractors and people who have changed roles keep working credentials they have no legitimate need for. Those credentials can be used to read, copy or alter information, and if they are compromised by an attacker they provide a ready-made foothold that nobody is watching. Lingering access also undermines the accuracy of your access records, making it harder to prove who could reach what and weakening any assurance you give to auditors or partners.
Operational notes
Day to day, this control lives or dies on how quickly the people who know a requirement has ended tell the people who can act on it. Managers, HR, procurement and project leads are usually the first to know that someone is leaving, finishing or moving; IT and system owners are the ones who disable or remove the access.
Keep the trigger list broad. It is not only terminations: role changes, end of contract, end of a project or secondment, and a temporary access grant reaching its end date all mean the legitimate requirement has gone. Treat "systems and their resources" broadly too, covering not just the network or directory account but shared drives, applications, SaaS tenants, databases, remote access, physical tokens and any service accounts or API keys the person controlled.
Where full removal takes time (data handover, mailbox retention, licence reassignment), suspend first the same day and complete the removal afterwards. Record the date the requirement ended and the date the access was suspended or removed, so you can show they match.
Implementation tips
- HR and people managers: notify the IT service desk or identity team on the day a person leaves, finishes a contract, changes role or completes a project, using a standard leaver or change-of-role form that records the date the access requirement ends.
- Identity and access administrators: on receipt of that notification, disable or remove the person's accounts in the directory and identity provider that same day, then work through every connected system and resource (email, shared drives, applications, SaaS tenants, databases, remote access) using an access inventory for that person.
- System owners: link account status to the HR or contractor record so that a leaver or role-change event automatically suspends the associated accounts on the effective date, with manual removal following for anything not covered by automation.
- Managers granting temporary or project access: set an expiry date on the access at the time it is granted so it is suspended automatically when the project or engagement ends, rather than relying on someone remembering.
- Identity team: for role changes, remove the access tied to the old role on the day of the move (not just add the new access), and reconcile the person's remaining entitlements against their new role so nothing legitimate is lost and nothing surplus stays.
Audit / evidence tips
- AskAsk for the documented procedure for removing or suspending access when a user no longer needs it, including who triggers it and who actions it.Look atCheck that the procedure sets a same-day timeframe, covers leavers, contractors, role changes and end of project or temporary access, and includes systems and their resources rather than just the main login.GoodA clear procedure that requires removal or suspension on the same day the requirement ends, names the roles responsible for notifying and actioning, and lists the resources to be covered.
- AskRequest a list of people who left, finished contracts or changed roles in a recent period, together with the dates their access requirement ended.Look atCompare those dates with the dates their accounts were disabled or removed in the directory, identity provider and key applications.GoodFor every person sampled, the suspension or removal date is the same as the date the requirement ended, with any exceptions explained and documented.
- AskAsk for the leaver, contractor-completion and role-change notifications sent to IT for the sampled people.Look atCheck that a notification exists for each person and that it was sent on or before the day the requirement ended, not days later.GoodTimely notifications exist for all sampled cases, showing the trigger reached the people who action access on the same day.
- AskRequest a current list of enabled accounts and compare it against the current staff and contractor register.Look atLook for enabled accounts belonging to people who are no longer employed or engaged, or whose recorded role no longer justifies the access.GoodNo enabled accounts belong to people without a current legitimate requirement, or any found are recent and already in the process of being suspended the same day.
- AskAsk for evidence of how access to the wider resources (shared drives, applications, SaaS tenants, remote access, tokens) was handled for the sampled people.Look atCheck the access inventory or removal checklist for each person to see that each resource was suspended or removed and when.GoodEach sampled person has a completed checklist or system record showing all their systems and resources were suspended or removed on the same day, with any staged full removal completed afterwards.
Cross-framework mappings
How ISM-0430 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(3)expand_less | ||
| Annex A 5.15 | ISM-0430 requires rapid deprovisioning by removing or suspending access the same day it is no longer legitimately required | |
| Annex A 5.16 | ISM-0430 requires that access to systems and resources is removed or suspended the same day a user no longer has a legitimate need | |
| Annex A 5.18 | ISM-0430 requires same-day removal or suspension of access when it is no longer required | |
sync_altPartially overlaps(2)expand_less | ||
| Annex A 5.11 | Annex A 5.11 requires that, when personnel or other interested parties leave or change roles, they return all organisational assets in th... | |
| Annex A 6.5 | Annex A 6.5 requires information security responsibilities and duties that continue after termination or a role change to be defined, enf... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in System access
See all Guidelines for system access controls, or browse the full ASD ISM library.