ASD ISM 0817 Reporting suspicious online contact awareness
What it says
Personnel are advised of what suspicious contact via online services is and how to report it.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishStaff learn to recognise and report suspicious online contact.
This control is about making sure that everyone in your organisation knows how to spot and report any suspicious contact they might experience online, like strange emails from unknown sources. It matters because ignoring these signs can lead to serious issues like data breaches, which can harm your reputation and cost you time and money to fix.
Free. Save your status, tasks and notes.
Why it matters
Failing to report suspicious online contact promptly can lead to exposure of sensitive information, resulting in data breaches and reputational damage.
How to implement
Managers should ensure all staff attend security awareness training.
Organise a workshop where employees learn to identify signs of phishing, scam emails, and other suspicious activities. Use examples of real-world incidents to make the training relatable and engaging.
IT departments should provide clear instructions for reporting suspicious contacts.
Develop a simple one-page guide that explains who to contact and what information to share when reporting suspicious emails or messages. Ensure this guide is accessible to all employees, such as on the company intranet.
HR departments should incorporate cyber safety into the onboarding process.
Include a session on recognising and reporting suspicious online contacts in new employee orientation. Provide them with key contact points and resources for ongoing support.
Compliance officers should regularly review and update reporting procedures.
Schedule quarterly meetings to assess the effectiveness of reporting processes and make adjustments as needed. Gather feedback from employees about the ease of reporting to ensure the process remains user-friendly.
Team leaders should foster an open culture about reporting cyber threats.
Encourage team discussions where employees can share experiences and strategies for dealing with suspicious online contact. Reinforce that reporting such incidents is a critical part of protecting the organisation.
Keep it running
Train staff to recognise suspicious online contact (e.g., probing, grooming, unusual requests) and require prompt reporting via the security incident channel.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The cyber security awareness training records.
Look at
Attendance records and training materials to verify that all staff have undergone training.
Good evidence
Includes signed attendance sheets and up-to-date training materials tailored to spotting suspicious contacts online.
- Check 2 of 5What an auditor asks for
Look at
The guide to ensure it clearly outlines steps employees should take when encountering suspicious messages.
Good evidence
Is a simple, well-organised document that's distributed across the organisation.
- Check 3 of 5What an auditor asks for
Ask for
Examples of communications related to recent suspicious incident reports.
Look at
These records to confirm prompt reporting and response by the designated security team.
Good evidence
Shows timely reporting and resolution details within the organisation's incident management framework.
- Check 4 of 5What an auditor asks for
Look at
The feedback to gauge satisfaction and highlight any areas needing improvement.
Good evidence
Includes constructive feedback and documented efforts to address any concerns.
- Check 5 of 5What an auditor asks for
Ask for
Records of communications or sessions conducted during onboarding processes.
Look at
Sections covering cyber security basics and reporting protocols.
Good evidence
Is a comprehensive onboarding plan that integrates cyber security education effectively.
Mappings
Closest match in ISO/IEC 27001: A.6.3, Information security awareness, education and training program, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.6.3.
Annex A 6.3 requires organisations to deliver information security awareness and training appropriate to roles, including behavioural expectations and reporting pathways. ISM-0817 requires advising personnel about suspicious online contact and how to report it, which is a discrete awareness topic. ISM-0817 is therefore a subset of what Annex A 6.3 would cover within a broader, ongoing program.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.