ASD ISM 0613 Requirement for gateway system administrators nationality
What it says
System administrators for gateways that connect to Australian Eyes Only or Releasable To networks are Australian nationals.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnly Australian nationals can manage gateways to certain secure networks.
This control means that only Australian citizens are allowed to manage certain critical communication networks, such as those exclusive to Australia or shared securely with specific partners. This matters because using non-citizens might expose these sensitive networks to greater risks, like espionage or unauthorised access, which could harm national security.
Free. Save your status, tasks and notes.
Why it matters
If gateway admins are not Australian nationals, AEO/REL networks may be exposed to foreign influence and unauthorised access, increasing espionage and data compromise risk.
How to implement
HR should verify citizenship: Before hiring system administrators for these roles, HR must ensure candidates are Australian citizens by checking their birth certificate or passport.
This step verifies legality for managing secure networks.
System owners should update job descriptions: Clearly state the requirement for Australian citizenship in job ads for administration roles on these networks.
This helps to filter applicants and sets expectations early.
IT managers should conduct regular reviews: Every six months, IT managers should audit the list of current system administrators to ensure all meet the Australian nationality requirement.
Use citizenship documents to verify compliance.
Leadership must provide training: Offer training to all team leaders on the importance of this control and national security.
This training can include workshops and online courses to enhance awareness among staff.
Procurement should consult legal experts: When contracting outside administrators, procurement teams should consult legal advisors to ensure compliance with the control and Australian privacy laws.
This ensures contractors understand the rule and its importance.
Keep it running
Verify gateway administrators are Australian nationals before granting admin access; record evidence, review periodically, and maintain a vetted Australian-national backup roster for rapid replacement.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The HR recruitment checklist.
Look at
The listed nationality checks for roles managing secure networks.
Good evidence
A document showing these positions require Australian citizenship verification.
- Check 2 of 5What an auditor asks for
Ask for
The list of current system administrators.
Look at
Nationality confirmation documents, such as passport or birth certificate copies.
Good evidence
Every administrator having a verified Australian citizenship document on file.
- Check 3 of 5What an auditor asks for
Ask for
To see recent internal audits of administrator roles.
Look at
Findings and actions on compliance with citizenship requirements.
Good evidence
Findings reviewed, actions taken for non-compliance, and signed acknowledgments by IT managers.
- Check 4 of 5What an auditor asks for
Ask for
Training records: Request details of training sessions conducted for team leaders on the importance of this control.
Good evidence
Attendance lists and training materials showing focus on national security restrictions.
- Check 5 of 5What an auditor asks for
Ask for
Contractor management policies.
Look at
Guidelines that ensure contractors managing secure networks are aware of and comply with this control.
Good evidence
A signed contract clause explicitly requiring personnel to be Australian citizens.
Mappings
Closest match in ISO/IEC 27001: A.6.1, Personnel background verification, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.6.1.
ISM-0613 requires that system administrators for gateways connecting to Australian Eyes Only or Releasable To networks are Australian nationals. Annex A 6.1 requires personnel background verification to be performed proportionate to information classification and risk, which can include verifying nationality/citizenship status where required. ISM-0613 is a specific, mandatory eligibility criterion for a particular high-risk admin role, whereas Annex A 6.1 is a broader screening control that does not inherently mandate Australian nationality.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.