ASD ISM 0447 Restrict privileged access for foreign nationals
What it says
Foreign nationals, excluding seconded foreign nationals, do not have privileged access to systems that process, store or communicate AGAO data.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishForeign nationals can't have privileged access to systems handling AGAO data except if seconded.
This rule means that foreign nationals aren't allowed to have special access to important systems that handle sensitive Australian Government data, unless they are temporarily working as part of an agreement. This is crucial because if those who aren't local don't have the right checks or trust, they could accidentally or intentionally harm the systems or data, leading to data theft, system failure, or breaches.
Free. Save your status, tasks and notes.
Why it matters
If foreign nationals have privileged access, AGAO data may be exposed or altered, increasing risk of unauthorised disclosure and national security harm.
How to implement
HR and management should establish a clear policy on who qualifies as a 'seconded foreign national' for this purpose.
They should outline the criteria and document the process for how foreign nationals can be seconded to ensure everyone follows the same guidelines.
Managers should update system access policies to clearly specify that only local personnel or seconded foreign nationals can have privileged access.
This can be done by revising existing policies and training staff to understand and implement these rules.
The IT team should implement an access control process that includes checking nationality status before granting privileged access.
This might involve adding a nationality verification step into the user access request forms and ensuring that all IT staff are trained to follow it.
System owners should conduct regular reviews of access privileges to ensure compliance with this control.
They should create a schedule for checking and revoking privileged access from foreign nationals who are not seconded.
HR should work closely with system administrators to maintain an up-to-date record of all secondments involving foreign nationals.
This involves keeping a list of all seconded staff with privileged access, including their start and end dates, and ensuring the list is reviewed regularly.
Keep it running
Maintain a register of privileged accounts and verify holders are not foreign nationals (except seconded). Review access and revoke exceptions promptly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The access control policy documents regarding foreign nationals.
Look at
Whether the policy clearly states that only local or seconded foreign nationals can have privileged access.
Good evidence
The policy explicitly includes these restrictions and references organisational approval processes for secondments.
- Check 2 of 5What an auditor asks for
Look at
Their nationality status and check against the secondment register.
Good evidence
All foreign nationals with privileged access are listed as seconded in the records.
- Check 3 of 5What an auditor asks for
Ask for
Recent access review reports.
Look at
Documentation that shows reviews are being conducted and any occurrences of non-compliance.
Good evidence
Reports demonstrate timely reviews with actions taken to correct any issues.
- Check 4 of 5What an auditor asks for
Look at
Whether there is a nationality verification step included.
Good evidence
The logs show that nationality is checked before any privileged access is granted.
- Check 5 of 5What an auditor asks for
Ask for
Records of staff training on the access control policy.
Look at
Attendance lists and training materials.
Good evidence
Training records show that relevant staff have been educated on the policy and understand the restrictions.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
Annex A 5.15 requires organisations to establish and implement rules and procedures to control logical and physical access to information and associated assets based on business and security requirements. ISM-0447 is a specific access control policy rule restricting privileged access for foreign nationals to systems handling AGAO data. ISM-0447 is a narrow, classification- and nationality-based constraint within the broader access control policy framework required by Annex A 5.15.
This control partially meets A.8.2.
ISM-0447 requires that foreign nationals (except seconded foreign nationals) are not granted privileged access to systems that process, store or communicate AGAO data. ISO/IEC 27001:2022 Annex A 8.2 requires privileged access rights to be restricted and managed, which can include eligibility criteria such as citizenship/nationality. ISM-0447 is a specific nationality-based restriction for a defined data/system scope, whereas Annex A 8.2 is a broader privileged-access governance control covering all privileged access allocation and use.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.