ASD ISM 0435 Pre-access briefings for system resources
What it says
Personnel receive any necessary briefings before being granted access to systems and their resources.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishStaff must be briefed before accessing system resources.
This control is about making sure that staff get the right information before they use company systems. If people jump in without a briefing, they might not know how to use the system safely, which could lead to data breaches or other security problems.
Free. Save your status, tasks and notes.
Why it matters
Failure to conduct pre-access briefings can lead to staff mishandling sensitive data or exploiting privileged access, risking data breaches.
How to implement
Managers should ensure that new staff members receive a briefing on system access during their onboarding process.
This can be done by including a session in the induction program that covers the do's and don'ts of system use and security.
HR should create and maintain a checklist of topics to cover in pre-access briefings.
This checklist should include things like password security, recognising suspicious emails, and data protection basics.
The IT team should provide specific training materials suited to the systems staff will use.
These could be in the form of guides, online courses, or videos that explain how to securely access and use the systems.
System owners should periodically review and update the briefing materials to ensure they reflect any changes in the system or its security requirements.
They can do this by setting a regular check-in schedule, perhaps every 6 months, to update the content.
Team leaders should perform regular checks to ensure all staff who access the systems have received the briefings.
They could schedule quick catch-ups or send out surveys to confirm that their team members understand the key security protocols.
Keep it running
Ensure briefings cover system usage policies and access protocols; maintain records of briefings as part of access control audits.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The onboarding program materials: Request documents or presentation slides used during staff induction.
Look at
The content to see that system security and access procedures are included.
Good evidence
Is up-to-date materials with clear information on the security practices required before access is granted.
- Check 2 of 5What an auditor asks for
Ask for
Them what they were told about system access and security during their induction.
Look at
Consistency in their answers about key security points.
Good evidence
Is their ability to explain basic security practices and threats discussed in their briefings.
- Check 3 of 5What an auditor asks for
Ask for
Briefing attendance records: Request logs or sign-off sheets indicating who attended the briefings. Look to confirm that all new staff have participated before accessing systems.
Good evidence
Is a complete log showing all new hires, the date of attendance, and the topics covered.
- Check 4 of 5What an auditor asks for
Look at
Whether the session clearly covers important security practices in a way that is understandable to non-technical staff.
Good evidence
Is a structured session that engages participants and uses understandable language.
- Check 5 of 5What an auditor asks for
Ask for
A review schedule: Request documents that show when briefing materials are reviewed and updated.
Look at
The frequency and recency of updates.
Good evidence
Is a documented schedule or records showing regular content review and updates following system changes.
Mappings
Closest match in ISO/IEC 27001: A.6.3, Information security awareness, education and training program, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.6.3.
ISM-0435 requires personnel to receive any necessary briefings before being granted access to systems and their resources. ISO/IEC 27001:2022 Annex A 6.3 establishes an organisation-wide information security awareness, education and training program (including updates to policies and procedures) which can encompass pre-access briefings. ISM-0435 is more point-in-time and access-gating focused, whereas Annex A 6.3 is broader and ongoing across the employment lifecycle.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-14.1Require role-tailored cyber security awareness training before granting accessPartially overlaps
This control partially overlaps IT.PRO-14.1.
IT.PRO-14.1 requires all personnel to receive role-tailored cyber security awareness training before being granted access; ISM-0435 requires personnel to receive any necessary briefings before being granted access, a related pre-access step using briefings rather than training.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.