ASD ISM 0434 Ensure personnel employment screening and security clearance
What it says
Personnel undergo appropriate employment screening and, where necessary, hold an appropriate security clearance before being granted access to systems and their resources.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishStaff need job screening and security clearance for system access.
This control is about making sure that people who need access to important or sensitive systems go through proper background checks and, if needed, have a security clearance. This is crucial because if someone not properly vetted gets access, they could misuse sensitive information, leading to data breaches, financial losses, or harm to your organisation's reputation.
Free. Save your status, tasks and notes.
Why it matters
Without employment screening and required security clearances, unsuitable staff may gain access, increasing insider threat, data breaches and loss of trust.
How to implement
HR should perform thorough background checks: Before hiring, the HR team should verify employment history, qualifications, and conduct reference checks to ensure candidates are trustworthy.
This can be done by contacting previous employers and using professional screening services.
Managers should identify roles needing security clearance: Managers must determine which positions involve access to sensitive systems and require a security clearance.
They should list these roles and ensure candidates are informed about the need for clearance before hiring.
Assign a security officer to handle clearances: A security officer should be responsible for coordinating the security clearance process for new hires.
This involves understanding the levels of clearance required and liaising with the relevant authority to process applications.
IT should manage access rights carefully: The IT team needs to ensure that system access is only granted once the required checks and clearances are complete.
They should use an access management system to track and manage permissions.
Conduct regular reviews: Management should periodically review current employees' clearances and background checks to ensure they are still valid and appropriate for their roles.
This can be done annually or in response to changes in job functions.
Keep it running
Before granting access, verify HR screening completion and required clearance level; revalidate clearances and keep a current register mapped to roles and systems.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
A list of positions requiring security clearance: Request documentation that details which roles need clearance and why.
Look at
A clear rationale for each position and a list of positions. Good documentation will clearly define roles and associated clearance requirements.
Good evidence
Record includes contact details of referees and dates of checks.
- Check 2 of 4What an auditor asks for
Ask for
How employees are screened before being given system access.
Look at
A consistent and comprehensive explanation of steps taken.
Good evidence
Includes a detailed, step-by-step process of checks performed.
- Check 3 of 4What an auditor asks for
Look at
Details on how the clearances are processed and reviewed.
Good evidence
Document includes steps, responsible individuals, and review intervals.
- Check 4 of 4What an auditor asks for
Ask for
To see logs or records showing access was only granted after clearances.
Look at
Timestamps and approval signatures to ensure compliance.
Good evidence
Log shows a clear linkage between clearance approval and access granted date.
Mappings
Closest match in ISO/IEC 27001: A.6.1, Personnel background verification, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.6.1.
ISM-0434 requires personnel to undergo appropriate employment screening and, where necessary, hold an appropriate security clearance before being granted access to systems and resources. Annex A 6.1 requires background verification checks prior to employment and on an ongoing basis, proportional to risk and information classification, which aligns with the screening component of ISM-0434. ISM-0434 additionally emphasises clearance (where required) as a gating condition for system access, while Annex A 6.1 is broader on verification cadence and does not explicitly cover security clearances as an access prerequisite.
This control supports A.5.15.
ISM-0434 requires employment screening and, where necessary, security clearance before personnel are granted access to systems and resources. Annex A 5.15 supports this by requiring the organisation to define and implement rules and procedures to control physical and logical access based on business and security requirements, which is where screening/clearance outcomes are operationalised. Annex A 5.15 is broader across access policy design and enforcement, while ISM-0434 is specifically about personnel vetting/clearance as an access precondition.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.