ASD ISM 0443 Restrict temporary access to secure systems
What it says
Temporary access is not granted to systems that process, store or communicate caveated or sensitive compartmented information.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishTemporary access is not allowed for systems handling highly sensitive information.
This control is about ensuring that systems which handle very sensitive information shouldn't have temporary access granted to them. The reason for this is simple: if you allow short-term access to these systems, there's a risk someone could misuse that access and expose critical information. Keeping these systems secure helps protect against data leaks and potential financial or reputational harm.
Free. Save your status, tasks and notes.
Why it matters
Granting temporary access to systems handling caveated or sensitive compartmented information can enable unauthorised disclosure and compromise of classified operations.
How to implement
The IT manager should ensure proper policies are in place to restrict temporary access to secure systems.
This can be done by reviewing current access policies and creating guidelines that explicitly state temporary access is not allowed for sensitive systems.
System administrators need to configure the access settings on sensitive systems to disallow temporary access.
This involves checking current system configurations and updating them so that no user accounts are given temporary permissions.
HR should regularly communicate with staff about the importance of these access restrictions and ensure everyone understands why temporary access is not permitted.
This could be done through periodic training sessions or informational emails.
Management should conduct regular reviews to identify any potential loopholes where temporary access might be granted.
They should gather reports of system access attempts and assess if any policies need strengthening.
The security team should monitor access logs to ensure there are no attempts to bypass this restriction.
Tools that generate alerts for any unusual access requests should be configured to notify the team immediately.
Keep it running
Enforce policy that no temporary accounts or time-bound access are issued for caveated/SCI systems; audit account creation and approvals to detect exceptions.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The current access control policy document for sensitive systems.
Look at
Whether it includes a clause that prohibits temporary access.
Good evidence
Includes a clear statement forbidding temporary access for systems with sensitive information.
- Check 2 of 5What an auditor asks for
Good evidence
Shows no records of temporary access being granted.
- Check 3 of 5What an auditor asks for
Ask for
To see a recent training or communication provided to staff about access policies. Check that the material highlights the prohibition of temporary access.
Good evidence
Includes examples of emails or presentation materials covering this topic.
- Check 4 of 5What an auditor asks for
Look at
Timestamps and user IDs to ensure no temporary accesses occurred.
Good evidence
Shows regular access by authorised personnel with no temporary distribution.
- Check 5 of 5What an auditor asks for
Ask for
The settings configuration for these secure systems. Check that the option for temporary accesses is disabled.
Good evidence
Is a document or screenshot showing settings that restrict access permissions permanently.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.15.
ISM-0443 prohibits granting temporary access to systems that process, store or communicate caveated or sensitive compartmented information. ISO/IEC 27001:2022 Annex A 5.15 requires an organisation to establish and implement access control policies and procedures based on business and security requirements, within which a rule like "no temporary access for SCI/caveated systems" would be defined. Annex A 5.15 is broader (policy framework), while ISM-0443 is a specific, high-assurance prohibition for a particular classification context.
This control partially meets A.5.18.
ISM-0443 mandates that organisations do not grant temporary access to systems processing, storing or communicating caveated or sensitive compartmented information. ISO/IEC 27001:2022 Annex A 5.18 covers provisioning, reviewing, modifying and removing access rights across the access lifecycle, which is where rules about temporary or time-limited access are implemented and enforced. Annex A 5.18 is broader lifecycle governance, while ISM-0443 is a specific rule constraining one access mechanism for a particular sensitivity tier.
This control partially meets A.8.2.
ISM-0443 requires that temporary access is not granted to systems handling caveated or sensitive compartmented information. ISO/IEC 27001:2022 Annex A 8.2 requires privileged access rights to be restricted and managed, which can include limiting or disallowing time-bound/temporary privileged access. Annex A 8.2 applies to privileged access generally (not necessarily temporary access, nor tied to SCI/caveats), whereas ISM-0443 is a specific prohibition based on information sensitivity.
This control partially meets A.8.3.
ISM-0443 prohibits temporary access to secure systems that handle caveated or sensitive compartmented information. ISO/IEC 27001:2022 Annex A 8.3 requires restricting access to information and associated assets in line with an access control policy, which can include banning temporary access for certain systems. Annex A 8.3 is a general restriction requirement, whereas ISM-0443 is a specific, classification-driven prohibition that sets a stricter rule for a defined set of systems.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.