Skip to content
Gateways
ASD ISMISM-0610

ASD ISM 0610 Training human users on secure CDS use before granting access

What it says

Human users are trained on the secure use of CDSs before access is granted.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Nobody gets to use a Cross Domain Solution until they have been trained on how to use it securely, so training completion becomes a gate on access.

A Cross Domain Solution (CDS) is the controlled bridge between networks of different security classifications, such as a system that lets data move between a SECRET network and a lower-classified one. Because the CDS sits exactly at the boundary the organisation is trying to protect, the people who operate or submit data through it can undermine the whole arrangement through simple mistakes: sending the wrong file, mislabelling content, misunderstanding what the CDS will and will not inspect, or working around a control they find inconvenient. This control requires that every human user is trained on the secure use of the CDS before they are granted access to it. The sequencing is the point. Training is not a nice-to-have that happens sometime after onboarding; it is a precondition for access. Until a person has completed training on how to use the CDS securely, they should not have an account, credential or physical means of using it. It matters because CDS errors tend to be high-consequence and hard to reverse. Once classified or sensitive data has crossed to a lower domain, it cannot be recalled, and a user who does not understand the CDS may not even realise a spill has occurred. Trained users know what the CDS is for, what they are permitted to move through it, how to prepare and label data correctly, and what to do if something goes wrong.

Why it matters

If users can access a CDS before being trained, untrained people are operating the mechanism that separates classified and less-classified domains. That raises the likelihood of data spills (sensitive content released to a lower domain), of malicious or inappropriate content being imported into a higher domain, and of users bypassing or misusing CDS safeguards because they do not understand them. These incidents can trigger mandatory reporting, costly clean-up across multiple systems, loss of accreditation for the CDS, and damage to the trust that partner agencies place in the organisation.

How to implement

  1. The CDS system owner, with the security team, defines the content of secure-use training for the CDS: its purpose, permitted data flows, how to prepare and mark data, what the CDS does and does not check, common errors, and how to report a suspected spill.

  2. The training or security team builds this content into a deliverable module (briefing, e-learning or supervised walkthrough) with a completion record per person, and stores completion records in the learning management system or a controlled register.

  3. The access administrator amends the CDS access request form and workflow so that evidence of completed training is a mandatory input, and configures the workflow to reject or hold any request that lacks it.

  4. The CDS administrators create accounts, credentials or physical access for a user only after checking the training record, and note the training completion date alongside the access grant date in the provisioning record.

  5. The system owner reviews the training content whenever the CDS, its data flows or its procedures change, reissues the updated module, and reconciles the current CDS user list against training records at a set interval to find anyone provisioned without training.

Keep it running

In practice this control lives in the access provisioning workflow. Whoever approves and creates CDS access (typically the system owner or the CDS administrators, with the security team) needs a reliable way to confirm that training has been completed before the account or credential is issued. That usually means training completion is a mandatory field or attachment on the CDS access request form, and a request without it is rejected rather than parked.

The training itself should be specific to the CDS in use, not generic security awareness. It needs to cover what the CDS is for, which data flows are permitted, how to prepare, classify and mark data before it goes through, what the CDS checks and what it does not, common user errors and how to avoid them, and how to report a suspected spill or malfunction. Delivery can be a briefing, an e-learning module or a supervised walkthrough, as long as completion is recorded per person.

Keep a record for each user showing the training date and the date access was granted, so the ordering can be demonstrated later. When the CDS, its permitted data flows or its procedures change materially, update the training content so new users are trained on the current arrangement. Review the user list against training records periodically to catch anyone who was provisioned outside the normal process.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    Ask for the training material used for CDS users and the procedure that says training must be completed before access.

    Look at

    Check that the material is specific to the CDS in use (purpose, permitted flows, data preparation and marking, error handling, spill reporting) and that the procedure clearly makes training a precondition for access.

    Good evidence

    There is CDS-specific training content and a documented rule that no access is granted until it is completed.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Ask for the CDS access request form or workflow and a sample of recent approved requests.

    Look at

    Look for a mandatory training-completion field or attachment and confirm each sampled request contains it before approval.

    Good evidence

    Every sampled request shows training evidence recorded before the approver signed off, and the workflow cannot proceed without it.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Ask for the current list of CDS users with their access grant dates and their training completion dates.

    Look at

    Compare the two dates for each user and check that training predates access in every case.

    Good evidence

    All users have a training completion date on or before their access grant date, with no gaps or missing records.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Ask how the organisation confirms training was completed by the individual, not just assigned.

    Look at

    Look at the completion record format (attendance sign-off, module completion, assessment result) and who signs or generates it.

    Good evidence

    Completion is recorded per named person by the trainer or learning system, not self-declared in free text.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Ask for the most recent reconciliation of CDS users against training records and any exceptions found.

    Look at

    Check that the reconciliation is performed, that exceptions were investigated, and that access was removed or training completed where a gap was found.

    Good evidence

    Periodic reconciliations exist, exceptions are rare, and each one has a documented resolution.

Mappings

Closest match in ISO/IEC 27001: A.6.3, Information security awareness, education and training program, which this control partially meets.

ISO 27001

ISO/IEC 27001: 3 mappings

  • A.6.3Information security awareness, education and training programPartially meets
  • A.5.15Access control policies and proceduresSupports
  • A.5.18Managing access rights to information assetsSupports

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.