ASD ISM 0432 Document system access requirements in security plans
What it says
Access requirements for systems and their resources are documented in their system security plan.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSystem access rules must be documented in each system's security plan to ensure proper access management.
In everyday terms, this control is about clearly writing down who can access specific parts of your system and under what conditions. It's important because if these access rules aren't properly documented, the wrong people might gain access, leading to data breaches, loss of sensitive information, or system misuse.
Free. Save your status, tasks and notes.
Why it matters
If access requirements are not documented in the system security plan, incorrect permissions may be granted, enabling unauthorised access and data compromise.
How to implement
The IT manager should create a document outlining system access rules.
This involves listing who needs access, what they need access to, and why they need it. Use simple spreadsheets or word documents to write this down and keep it updated.
System owners should regularly update the security plan with any changes in access needs.
Review access rules any time there is a change in staff roles or responsibilities to ensure only the right people have access.
Managers should work with HR when an employee leaves the organisation.
Remove access immediately to prevent unauthorised access. Use a checklist to ensure all their system accounts are closed.
The IT team should set up alerts for any unusual access attempts.
This involves using your existing security tools to notify you if there are multiple failed logins or access from unexpected locations.
System owners should hold quarterly meetings with IT and security officers to review and update access rules.
This ensures all changes are documented and aligns with any new security threats or business needs.
Keep it running
Review and update the system security plan whenever roles, resources or permissions change, and confirm access requirements map to implemented controls (e.g., RBAC and approvals).
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The current system access document.
Look at
A document that details who can access what parts of the system.
Good evidence
Includes specific names, roles, and what each role can do.
- Check 2 of 4What an auditor asks for
Ask for
Them what parts of the system they can access and why.
Good evidence
Matches the actual access to what's documented and they understand their access rights.
- Check 3 of 4What an auditor asks for
Look at
How frequently access rules are updated and discussed. Good evidence shows regular discussion and updates when staff or roles change.
- Check 4 of 4What an auditor asks for
Ask for
Logs or alerts from the security system that monitors such events. A healthy system will show few to no alerts, or logs that show proper follow-up action.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.15.
ISM-0432 requires that access requirements for each system and its resources be documented in the system's security plan. Annex A 5.15 requires the organisation to establish and implement access control rules based on business and security needs, which should be captured at a system level. The ISO control is broader as it mandates the existence and implementation of access control rules, while ISM-0432 focuses specifically on documentation of system-specific access requirements in the security plan.
This control supports A.5.18.
ISM-0432 requires that system access requirements be documented in the system security plan. Annex A 5.18 governs how access rights are provisioned, reviewed, modified, and removed against access control rules. This lifecycle activity is strengthened when the system's required access rules and roles are clearly documented. ISM-0432 does not itself require provisioning/review execution, but it provides the authoritative system-specific baseline that Annex A 5.18 processes should follow.
This control supports A.8.2.
ISM-0432 requires documenting system access requirements, including for sensitive resources, in a system security plan. Annex A 8.2 requires the allocation and use of privileged access rights to be restricted and managed, which depends on having clear, documented privileged access requirements per system. The ISO control drives operational management of privileged access, whereas ISM-0432 is about ensuring the requirements are formally recorded for that system.
ASD Essential Eight: 1 mapping
This control supports E8-RA-ML1.1.
E8-RA-ML1.1 requires organisations to validate privileged access requests upon initial request. ISM-0432 supports this by requiring access requirements to be documented in the system security plan, which provides the baseline for deciding whether a privileged access request is justified. ISM-0432 is documentation and planning focused, while E8-RA-ML1.1 is the approval/validation control performed when access is requested.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.