ASD ISM 0446 Restrict privileged access for foreign nationals
What it says
Foreign nationals, including seconded foreign nationals, do not have privileged access to systems that process, store or communicate AUSTEO or REL data.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishForeign nationals can't access Australian systems with sensitive data privileges.
Foreign nationals should not have high-level access to Australian systems that contain sensitive government data. This is important because allowing foreign nationals access could lead to accidental or intentional data breaches that could harm national security or compromise sensitive information.
Free. Save your status, tasks and notes.
Why it matters
Foreign nationals with privileged access could expose or alter AUSTEO/REL data, risking national security and partner trust.
How to implement
System owners should identify which systems handle AUSTEO or REL data.
They can do this by reviewing the data classification of their systems and ensuring they are correctly labelled as containing sensitive information.
The IT team should set up access controls that specifically block foreign nationals from having privileged access to these sensitive systems.
They can achieve this by configuring user accounts and groups to ensure only approved Australian personnel have the necessary permissions.
HR should confirm the nationality of current employees with access to sensitive systems.
They can do this by reviewing personnel files and ensuring only Australians have privileged access based on their records.
Managers should regularly review access permissions to sensitive systems.
They can do this by checking the list of privileged users every quarter and ensuring that no foreign nationals are mistakenly granted access.
The security team should train staff on the importance of these restrictions.
They should conduct regular awareness sessions explaining why privileged access is limited and what the implications are if the control is not followed.
Keep it running
Audit privileged accounts and access logs to confirm foreign nationals have no admin rights on systems handling AUSTEO/REL data.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The access control list for systems handling AUSTEO or REL data.
Look at
The list to verify there are no foreign nationals with privileged access.
Good evidence
Outcome is a list showing only authorised Australian personnel have elevated access rights.
- Check 2 of 5What an auditor asks for
Ask for
A recent review report of access permissions.
Look at
Evidence of regular checks and corrections to unauthorised access.
Good evidence
Report will be dated within the last three months and show no foreign nationals have had privileged access.
- Check 3 of 5What an auditor asks for
Ask for
To see the HR nationality verification process documents.
Look at
How employee nationalities are verified and documented.
Good evidence
Process includes verified records of nationality checked against personnel files and signed off by HR.
- Check 4 of 5What an auditor asks for
Ask for
Training materials related to access control policies.
Look at
A clear explanation of why foreign nationals should have restricted access and evidence of training delivery. Good training records will show recent sessions and confirm attendance.
- Check 5 of 5What an auditor asks for
Ask for
A log of access change requests and approvals.
Look at
Any requests from foreign nationals for privileged access and their outcomes.
Good evidence
Log will show requests are denied and handled in accordance with the control requirements.
Mappings
Closest match in ISO/IEC 27001: A.5.16, Identity life cycle management, which partially overlaps with this control.
ISO/IEC 27001: 3 mappings
This control partially overlaps A.5.16.
Annex A 5.16 requires identity lifecycle management so that identity attributes, roles and entitlements are controlled as personnel join, move, or leave. ISM-0446 overlaps by imposing an eligibility constraint on privileged role assignment for foreign nationals on AUSTEO/REL systems, which must be enforced during onboarding, role changes, and periodic entitlement review. ISM-0446 is classification-specific and focused on privileged access eligibility, while Annex A 5.16 is broader and applies to all identity types and lifecycle stages.
This control partially overlaps A.5.18.
ISM-0446 prohibits foreign nationals from having privileged access to AUSTEO/REL systems. Annex A 5.18 covers provisioning, review, modification and removal of access rights to information assets, which would be used to ensure privileged access is not granted (or is removed) for foreign nationals on those systems. Annex A 5.18 is broader across all access rights and assets, whereas ISM-0446 is a specific rule about who must not receive privileged access for specific data classifications.
This control partially overlaps A.8.2.
ISM-0446 requires that foreign nationals (including seconded foreign nationals) are not granted privileged access to systems processing, storing or communicating AUSTEO or REL data. Annex A 8.2 requires privileged access rights to be restricted and managed, which is one of the mechanisms an organisation would use to prevent privileged access being granted to ineligible cohorts (such as foreign nationals). Annex A 8.2 is broader and generic (covering all privileged access management), while ISM-0446 is a specific eligibility restriction tied to nationality/secondment status and AUSTEO/REL systems.
ASD Essential Eight: 2 mappings
This control partially overlaps E8-RA-ML1.1.
ISM-0446 requires that foreign nationals are not granted privileged access to AUSTEO/REL systems. E8-RA-ML1.1 requires validation of requests for privileged access when first requested, which is a practical control point to check eligibility (including whether the requester is a foreign national) before granting access. E8-RA-ML1.1 is process-focused and applies generally, while ISM-0446 is a specific prohibition for a defined cohort and data sensitivity scope.
This control partially overlaps E8-RA-ML3.1.
ISM-0446 requires blocking privileged access for foreign nationals to systems processing, storing or communicating AUSTEO or REL data. E8-RA-ML3.1 limits privileged access to what is necessary for duties, which overlaps in the principle of restricting privileged access and could reduce or prevent unnecessary privileged access assignments to any user cohort. However, E8-RA-ML3.1 is about least privilege by job need, whereas ISM-0446 is an absolute eligibility restriction regardless of duty need for the specified systems/data.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.